Boardly Bookkeeping

Privacy

Privacy policy

Purpose

Boardly protects the privacy and confidentiality of the personal information it holds, in line with the Australian Privacy Principles (‘APPs’) and the Privacy Act 1988 (Cth) (‘Privacy Act’). Personal or sensitive information given to us is used only for the purpose it was given for, the purposes the person giving it would expect, or as the law allows. This policy explains how we collect, handle, use and disclose personal information. It also explains how an individual can ask for access to the personal information we hold about them, how to have it corrected, and how to make a complaint if they believe we have breached privacy law.

Scope

This Privacy Policy applies to Rebecca Rowe trading as Boardly Bookkeeping (ABN 11 293 347 336) (‘Boardly’). Boardly is a small business operator under the Privacy Act 1988 (Cth). It follows the Australian Privacy Principles voluntarily, and handles personal information as this policy describes. Boardly is legally bound by the Privacy (Tax File Number) Rule 2015 for tax file number information.

What personal information is

Personal information is information or an opinion about an identified individual, or about an individual who is reasonably identifiable from it. It is personal information whether or not it is true, and whether or not it is recorded in a material form.

The individuals we may collect personal information about are:

  • our clients and prospective clients, whether they are individuals, sole traders, partnerships, companies, trusts or trustees;
  • people whose details sit in our clients’ books, such as their staff, contractors, suppliers and customers;
  • people who visit our website, contact us or subscribe to our updates;
  • our suppliers and service providers;
  • people who work for us, or apply to, as employees or contractors; and
  • anyone else we deal with in the course of our business.

This policy calls all of these ‘individuals’.

What we ask for depends on the services we are providing. If an individual does not let us collect everything we ask for, we may be unable to provide some or all of those services properly.

If we receive personal information we did not ask for, and we could not have collected it under the Australian Privacy Principles, we destroy or de-identify it as soon as practicable, where that is lawful and reasonable.

The personal information we collect and hold

We collect personal information only where an individual knowingly gives it to us, authorises someone else to give it to us, or it comes from one of the other sources listed under “How we collect personal information”.

We ask for personal information only as far as we need it to provide services and information. This includes, among other things:

  • identification details: name, date of birth, address, phone number, email address and the online accounts an individual uses with us, and what we rely on to verify an individual’s identity, such as the type of identity document sighted (for example a driver’s licence, birth certificate or passport), without keeping a copy of the document or its full number;
  • financial details, such as income and expenses, bank and direct debit details, assets and liabilities, and superannuation and insurance details;
  • employment and payroll details, such as a person’s role, start and finish dates and employment records, pay rate or salary, hours worked, leave, superannuation fund and membership details, an ABN or ACN, and tax file numbers where a tax or superannuation law authorises us to collect them;
  • records of an individual’s dealings with us, including our services and any queries or complaints they make;
  • survey responses and other feedback, such as an individual’s experiences, activities, interests and views;
  • device and connection details when an individual uses our website, such as IP address, page view statistics, traffic to and from the site and standard web log information; and
  • anything else we need to know in order to deal with an individual.

We never adopt a tax file number, Medicare number, provider number or other number the government issues as our own way of identifying an individual in our records.

The Privacy Act restricts the collection of sensitive information. Sensitive information includes information about a person’s racial or ethnic origin, political opinions, religion, trade union membership, sexual orientation or criminal record, and health and biometric information. As a rule, we collect sensitive information only where we need it to provide a particular service or to meet a legal obligation, and the individual has consented.

If an individual chooses not to give us information

If we do not have all the information we need, we may not be able to provide the service.

Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information so that we can provide our services and deal with individuals. The purposes include, and are not limited to:

  • checking that an individual qualifies for a service;
  • providing the service;
  • doing our clients’ bookkeeping, payroll, bills and payment runs, and invoicing, which means handling details of the people they employ and do business with, on their behalf;
  • answering questions and booking discovery calls;
  • managing and improving our services;
  • meeting our legal and regulatory obligations;
  • preventing fraud, crime or other harmful activity connected with our services;
  • research and testing to improve our website and services, such as feedback surveys and website analytics, some of it through the service providers we use;
  • understanding and meeting an individual’s needs, including tailoring our website, emails, apps and social media content to their preferences;
  • marketing our business and services; and
  • anything else needed to run Boardly’s business.

Our services

We aim to give our clients one joined-up service that meets their goals, needs and expectations. Our services cover:

  • Bookkeeping
  • Payroll
  • Accounts payable
  • Accounts receivable
  • BAS services

How we collect personal information

We collect most personal information from the individual themselves, sometimes electronically (see “Information we collect electronically” below).

We also collect personal information from other organisations, sometimes without the individual being directly involved. For example, we collect personal information from:

  • publicly available sources;
  • our clients, who share details of their staff, contractors, suppliers and customers with us so we can do their work, either directly or through their Xero file and the bank, payroll and other apps connected to it, and, when a business moves onto Xero with us, through the records in the system it used before;
  • someone acting for the individual, such as their lawyer or mortgage broker, or a trustee, guardian, executor, administrator or attorney;
  • an individual’s employer;
  • other organisations that provide services to the individual together with Boardly; and
  • information aggregators and insight and analytics providers.

Laws that require or authorise us to collect personal information

The law requires or allows Boardly to collect:

  • Identification details for our clients and their representatives, to meet our obligations as a registered BAS agent under the Tax Agent Services Act 2009 (Cth), as explained in the Tax Practitioners Board’s guidance TPB(GS) 42/2022;
  • An individual’s tax file number, where they choose to give it, under taxation and superannuation law, including the Income Tax Assessment Act 1936 (Cth) and the Superannuation Industry (Supervision) Act 1993 (Cth).

How we hold personal information

We work to keep the personal information we hold relevant, reliable, accurate, complete and up to date, and to keep it private and secure. Much of it is held electronically in secure data centres run by external service providers, most of them outside Australia (see “Disclosure overseas”).

We use a range of electronic security measures to protect personal information. For example:

  • we control access to our systems through identity and access management;
  • everyone who works for Boardly, including contractors, must follow policies and procedures for handling information securely;
  • everyone who works for Boardly, including contractors, is made aware of the legal limits on handling tax file number information; and
  • we regularly monitor and review compliance with our internal policies and accepted industry practice.

We take reasonable steps to manage the destruction of digital data, including data that third parties hold or manage for us.

Who we disclose personal information to, and why

We may give personal information to organisations outside Boardly. To protect personal information, Boardly takes reasonable steps to ensure its service providers handle personal information securely. Some service providers’ own terms allow them to use the information they hold to operate and improve their own services.

Most disclosures are to organisations that help us run our business. They may include:

  • people who work for Boardly;
  • the client whose books hold the information, when we report back to them or act on their instructions;
  • the Australian Taxation Office and other government bodies, when we lodge or report to them for a client, such as an activity statement or a Single Touch Payroll report;
  • the businesses that help us run Boardly, such as our software, cloud, analytics and insight providers (including third-party AI providers), and anyone we contract to help us deliver our work;
  • payment system operators (for example, merchants that receive card payments);
  • other organisations that provide services to the individual together with Boardly;
  • financial services organisations, such as banks and superannuation funds;
  • our professional advisers and agents;
  • anyone acting for the individual, such as their accountant, lawyer or mortgage broker, or a trustee, guardian, executor, administrator or attorney, and anyone else the individual tells us may receive their information;
  • law enforcement bodies, regulators and other government agencies, in Australia or elsewhere; and
  • social media and digital platforms.

We may also share an individual’s personal information when:

  • the law requires or authorises us to, or we have a public duty to;
  • the individual has expressly consented, or their consent can reasonably be inferred from the circumstances; or
  • the Privacy Act otherwise permits it.

Despite anything else in this policy, as a registered BAS agent, Boardly does not disclose information relating to a client’s affairs to a third party without the client’s permission, unless we have a legal duty to do so.

Personal information may be used and disclosed for any of these purposes, and also for a secondary purpose that is related to the primary purposes above and which the individual would reasonably expect, or where the Privacy Act otherwise authorises it. We use and disclose sensitive information only for the purpose it was given for, or a directly related secondary purpose that the individual would reasonably expect, unless the individual agrees to something else or the Privacy Act allows an exception. Whatever else this policy says, tax file number information is collected only for a purpose a taxation or superannuation law authorises, and is used or disclosed only for such a purpose or to give an individual the tax file number information we hold about them. It is destroyed or de-identified once no law requires us to keep it and no such purpose needs it.

Disclosure overseas

We may disclose personal information to recipients outside Australia, including:

  • our data hosting, AI and other IT service providers; and
  • other third-party service providers.

These recipients are located in the United States, Canada and New Zealand, and in other countries where our service providers, or the companies they use, have facilities.

Third parties store, back up or mirror much of the data we hold outside Australia. We send personal information to a recipient outside Australia only where:

  • we have taken reasonable steps to ensure the recipient does not breach the APPs (other than APP 1) in handling it;
  • we reasonably believe the recipient is subject to a law or binding scheme that protects the information in a way at least substantially similar to the APPs, and the individual can use that law or scheme to enforce it; or
  • we have told the individual plainly that, if they consent, we will not be taking those steps, and they consent after being told.

Marketing

We may use personal information to tell individuals about services we think will interest them, unless they ask us not to. We may do this by post, phone, email, text message or other electronic channels, including social media.

We may also give personal information to companies that help us with our marketing.

An individual can opt out of marketing at any time using the contact details under “Key Contact”. Our marketing emails always say they are from Boardly and carry an unsubscribe link that works. Once someone unsubscribes, we stop sending them marketing within five business days.

Information we collect electronically

We collect some information electronically, for example when an individual browses our website or uses a mobile or tablet application.

When an individual visits our website, we collect information about the visit, which may include:

  • the date and time of the visit;
  • the pages viewed;
  • how the visitor moves through the site and interacts with pages, including fields completed in forms;
  • the visitor’s location;
  • the device used; and
  • the IP address.

Our use of cookies and similar technologies is described under “Cookies and similar technologies” below.

We never ask anyone to share personal information publicly on LinkedIn, Facebook, X or other social media we use. If we need someone’s details to help them there, for example to answer a question, we may ask them to send those details by private message.

Cookies and similar technologies

A cookie is a small file that a website stores on your device. Our website doesn't use cookies for analytics or advertising, and we don't track you across other websites.

Our website does rely on a few services from other companies, which may collect some technical information when you visit:

  • Cloudflare hosts our website. It receives your IP address and browser details so it can deliver our pages and protect the site from attacks, and it may set a cookie to check that you're not a bot.
  • Cloudflare Web Analytics counts visits so we can see which pages are read and how visitors find us. It doesn't use cookies or store anything on your device, and it doesn't identify or track individual visitors.
  • Google Fonts supplies the typefaces on our pages. Your browser downloads them from Google, which receives your IP address and browser details. Google Fonts doesn't set cookies.
  • Google Calendar runs the booking calendar on our Book a call page. Google may set cookies when the calendar loads, especially if you're signed in to a Google account. The details you enter to book a call are sent to Google and to us.

These companies may process information outside Australia. Google’s explanation of how it uses information from websites using its services is at policies.google.com/technologies/partner-sites, and Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

Your browser settings let you block or delete cookies whenever you like. The site will still work, although the booking calendar may not load if you block Google's cookies. If that happens, email [email protected] to book.

If we start using any other analytics tool, or any advertising tool, we'll update this policy before we do.

This policy applies to any personal information collected through these services.

Does Boardly use automated decision-making or AI?

We use software in our bookkeeping, payroll and bills work, and some of that software is AI supplied by third-party providers. The AI tools take on the repetitive tasks: they draft pay runs, payment runs and reports, code transactions, and match payments with bills.

The information the tools work with comes from our clients’ Xero files, payroll records and connected apps. The personal information in it is of four kinds:

  • details of transactions, and of the invoices and receipts behind them;
  • for the people our clients employ, pay or invoice, their names and contact details;
  • for our clients’ staff, their hours and pay rates, allowances, deductions and leave, and their superannuation fund and membership details; and
  • bank and payment details, such as account numbers.

Our AI tools are never given tax file numbers.

People at Boardly stay in charge of this work. Someone on our team checks what the tools produce, and a person at Boardly is responsible for the result. Our registered BAS agent reviews and signs off every activity statement and Single Touch Payroll report before it is lodged, and a person at Boardly checks every client report and payment run before it goes to the client. We keep a record of every step and of who checked it.

At Boardly, no computer program makes a decision on its own where that decision could reasonably be expected to significantly affect the rights or interests of an individual.

The decisions below can affect people’s rights or interests, and our AI tools do work that is substantially and directly related to making them. A person makes every one of these decisions: our client, or someone at Boardly who has checked what the AI tools produced. The decisions are:

  • decisions on how much a client pays each member of its staff in a pay run, together with the tax withheld, superannuation and any leave, where our AI tools draft the figures; and
  • decisions by our clients to pay their suppliers, where our AI tools enter bills and prepare payment runs for our client’s approval. Our client approves and makes every payment, and we never move our clients’ money.

Visiting our website does not lead to any automated decision about you. Anyone with a question about our AI tools can email us at the address under “Key Contact”.

How we keep information secure

We protect the information we hold with security tools and procedures. Our internal policies on how our people conduct themselves, the review of all work and conflict of interest checks guard against sensitive information being misused or disclosed unlawfully. When another organisation supports our work, we take reasonable steps to make sure it keeps the information we give it private and safe.

When we no longer need personal information, we either keep it securely where we need it for our records, delete it, or permanently de-identify it, in line with the law and our own records management policy.

Seeing and correcting your personal information

Under the Australian Privacy Principles, which Boardly follows, an individual can ask us for access to the information we hold about them, subject to some exceptions, and can ask us to correct information that is inaccurate, incomplete or out of date. For either, email us at the address under “Key Contact”. We aim to reply within a reasonable time, normally within 30 days.

There is no charge for making an access request or for having information corrected. If an individual asks for access more than once in twelve months, we may charge a reasonable amount to cover finding the information and supplying it.

In some circumstances we are not required to give an individual access to their personal information. If we refuse to give access or to make a correction, we will give the individual a notice explaining why, unless that would be unreasonable, and tell them how to complain about the refusal. If we refuse a correction, the individual can also ask us to attach a statement to the information recording that they disagree with its accuracy.

Notification

Boardly holds tax file number information, which makes it a file number recipient under the Privacy Act 1988 (Cth). Under Part IIIC of the Privacy Act (the Notifiable Data Breaches scheme), Boardly is legally required to notify the Office of the Australian Information Commissioner and affected individuals of any eligible data breach involving tax file number information. For a breach involving other personal information, Boardly will tell affected clients as soon as practicable. To meet this requirement, Boardly has a data breach response procedure. It covers how we deal with an actual or suspected data breach and how we tell the Office of the Australian Information Commissioner and the individuals affected.

Complaints

An individual who is concerned about how we are handling their personal information, or who wants to complain that Boardly has breached the Australian Privacy Principles, can email us at the address under “Key Contact”.

We aim to acknowledge a complaint within 1 business day of receiving it, and we will tell the individual if we need more information to resolve it.

We aim to answer a complaint within 10 business days and to resolve it as quickly as we can. Some take longer, and when one does, we will tell the individual what is happening and give them a date by which to expect our answer.

An individual who is not satisfied with our answer can lodge a complaint with the Office of the Australian Information Commissioner. The Commissioner’s powers over Boardly cover tax file number information, and for other matters the Commissioner will tell the individual whether it can look into the complaint.

The Commissioner can be contacted at:
Office of the Australian Information Commissioner
GPO Box 5288
Sydney NSW 2001
Phone: 1300 363 992
Online: www.oaic.gov.au/privacy/privacy-complaints

Key Contact

The individual can contact Boardly by emailing [email protected].

Policy updates

We may update this policy from time to time. We publish each update on our website, with a new version number and date below. An update takes effect when we publish it, except as the next paragraph says.

If you are our client, our Terms of Business, your Engagement Letter and this policy together make up your contract with us. If an update to this policy affects your rights or obligations under that contract, we will tell you in writing at least 30 days before that part of the update takes effect, as our Terms of Business set out. Until then, the earlier wording of that part continues to apply to you. Our Terms of Business also set out what you can do if you don't accept the update.

Version 5.0, dated 12 November 2026.