Privacy Policy
How we collect, use, store and protect your personal information. Website rules are in our Terms & Conditions.
1. Who we are and how to contact us
Profit Cloud Accounting is the trading name of Depacioli Pty Ltd (ABN 67 160 934 538). Depacioli Pty Ltd provides BAS services as a registered agent (registered agent number 27798003). Our other tax services are provided by Depacioli Pty Ltd under the supervision of The Accounting Academy Services Pty Limited (ABN 93 671 788 355, registered agent number 26233096), which is our supervising registered agent. Depacioli Pty Ltd and The Accounting Academy Services Pty Limited work together on client engagements through shared software, and both handle personal information in line with this policy.
For privacy questions, requests or complaints, please contact:
- Email: admin@profitcloud.online (please put "Privacy" in the subject line)
- Post: 29/97 Creek Street, Brisbane City QLD 4000 (our registered office)
2. What personal information we collect
Personal information is information or an opinion about an identified person, or a person who is reasonably identifiable. Depending on the services you use, we may collect:
- identity information, such as your name, date of birth and signature
- contact information, such as your address, email address and phone numbers
- financial and tax information, such as income, assets, liabilities, bank account details, transactions, tax returns and other dealings with the ATO and other government agencies
- employment information, such as your employer, occupation, pay and superannuation details, and payroll information about your employees
- identity document details, such as copies or details of your driver licence, passport or Medicare card, and a facial image (selfie) matched against your document, collected to verify your identity
- information about people connected with you, such as family members, spouses, directors, shareholders, trustees, beneficiaries, partners, beneficial owners and employees
- information you give us when you use our website, contact us, buy a digital product or subscribe to our updates.
If you give us information about another person, please let them know and point them to this policy.
You do not have to give us your personal information. However, if you do not, we may not be able to provide our services, verify your identity or act for you.
Tax file numbers
We collect tax file numbers (TFNs) where we need them to provide tax services. We collect, use, store and disclose TFNs only for lawful tax-related purposes, as permitted by taxation law and the Privacy (Tax File Number) Rule 2015. We store TFNs securely and limit access to them.
3. How we collect personal information
We collect personal information mainly from you, for example through our engagement process, forms, client portal, emails, phone calls and meetings. We may also collect it from:
- the ATO, ASIC and other government agencies, including through our registered agent portals
- your previous accountant or adviser
- bank feeds and accounting or payroll software you connect to us, or give us access to
- identity verification services we use to check identity details and documents
- other people you authorise to give us information, such as your financial adviser, lawyer, mortgage broker or employer
- this website, including contact and enquiry forms, purchases and subscriptions.
4. Why we collect, use and hold personal information
We collect, use and hold personal information to:
- provide our accounting, tax, BAS, bookkeeping, payroll, company secretarial and advisory services
- verify identity and help prevent fraud, including confirming the identity of the people and entities we act for and the people who own or control them
- meet our legal and professional obligations, including under taxation law, the Tax Agent Services Act 2009 (Cth) and the Code of Professional Conduct, and anti-money laundering and counter-terrorism financing (AML/CTF) law where it applies to a service we provide
- manage our relationship with you, including communicating with you and running our client portal
- issue invoices, collect payments and recover overdue amounts
- deliver digital products and courses you buy from us
- improve our services and our website
- send you updates, newsletters and marketing about our services, as described below.
Marketing
We may send you news, updates and information about our services by email or other channels. You can opt out at any time by using the unsubscribe link in our emails or by contacting us. Opting out of marketing will not stop us sending you messages we need to send to provide our services.
5. Who we disclose personal information to
We disclose personal information only as needed for the purposes above, or where you consent or the law requires or allows it. This may include:
- the ATO, ASIC, the Tax Practitioners Board, AUSTRAC and other government agencies
- between Depacioli Pty Ltd and The Accounting Academy Services Pty Limited, which work together on your engagement through shared software
- our staff and contractors, who are bound by confidentiality obligations
- software and service providers we use to run our practice, including cloud storage, email, accounting, practice and client management, document-signing, AI, identity verification and payment providers. For example, we use Apxium to send invoices and reminders and to process payments
- people you ask us to deal with, such as your financial adviser, lawyer, bank or broker
- professional body quality reviewers, such as Chartered Accountants ANZ, as part of quality assurance reviews
- anyone else where the law requires or authorises it, such as a court order or a legal reporting obligation.
We do not sell your personal information.
6. Storage and processing outside Australia
We store and process information using cloud-based software, including Google Workspace, Xero, QuickBooks, our client management system, and our document-signing and payment platforms. Our client management system stores its data in Australia. Some of our other providers store or process information outside Australia. Details are in each provider's published terms. We choose providers that commit to keeping information secure and confidential.
7. Our use of artificial intelligence (AI)
Many of the systems we use, including our accounting, email and document software, have built-in AI features. We also use AI tools we have approved for tasks such as drafting, research, extracting data from documents and summarising. Using these systems and tools is part of how we deliver our services.
- Clients consent to our use of these systems and tools, including with their personal information, through our engagement letter.
- When we approve an AI tool, we check that its terms keep client information confidential. Some AI providers may store or process information outside Australia.
- Our team checks AI-assisted work before we rely on it, and a registered agent remains responsible for the advice we give you and anything we lodge for you.
- Our Cybersecurity Policy for Generative AI, referred to in our engagement letter, sets out how our team must use AI tools responsibly and securely.
8. Automated decisions
We use computer programs to help us verify the identity of clients and of the people who own or control client entities. This section explains how.
Personal information we use in these programs: name, date of birth, address, contact details, identity document details, a facial image (selfie), and details of the people who own or control an entity. We use Didit, an identity verification service connected to our client management system.
Decisions made solely by a computer program: none.
Decisions where a computer program does something substantially and directly related to making the decision: whether we can verify your identity, and so whether we can accept or continue an engagement. The program checks your identity documents and matches your selfie to the photo on your document using facial (biometric) matching. A person in our team reviews the result, and that person decides whether we can accept or continue the engagement.
If you have questions about an identity check, or think a result is wrong, please contact us using the details in section 1.
9. How we protect personal information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include technical and organisational measures such as multi-factor authentication, restricted access to client information (only authorised staff can access it) and staff training. Client documents are stored in our document management systems and client portal. Clients may also choose to send us files through Dropbox, Google Drive or email.
No system is completely secure, and we cannot guarantee the security of information sent to us over the internet. If a data breach happens that is likely to cause serious harm (a notifiable data breach), we will tell the people affected and the Office of the Australian Information Commissioner (OAIC).
10. How long we keep information
We keep personal information only for as long as we need it for the purposes in this policy, or as the law requires. In particular:
- we keep copies of client records for at least 5 years, as required under the Tax Agent Services (Code of Professional Conduct) Determination 2024
- we keep records of the identity checks we carry out for at least 5 years from the lodgement they relate to, or for 7 years where AML/CTF law requires it
- we keep other records for as long as taxation, corporations and other laws require. When we no longer need personal information and the law no longer requires us to keep it, we take reasonable steps to destroy it securely or de-identify it.
11. Accessing and correcting your information
You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact us using the details in section 1. We will respond within a reasonable time, usually within 30 days. We may need to verify your identity first. If we refuse a request, we will tell you why in writing and how you can complain, unless the law allows us not to.
12. Privacy complaints
If you have a concern or complaint about how we have handled your personal information, please contact us first using the details in section 1. We will acknowledge your complaint, look into it, and respond in writing within 30 days.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
14. Changes to this policy
We may update this policy from time to time to reflect changes in the law, our services, our systems or feedback. We will post the updated policy on this page, and the "last updated" date at the top of the page shows when it last changed. If we make a significant change, we may also let our clients know directly.