Privacy Policy

1What personal information means

The Privacy Act defines personal information as information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true and whether or not it is recorded in a material form.

Some of what this website records is not personal information on its own — a scroll depth, a browser version — but becomes personal information once it is attached to an enquiry that carries your name. We treat it that way from the moment it is attached.

2What we collect

There are three kinds.

2.1What you tell us. When you complete an enquiry form we collect your first and last name, email address, phone number and the supports you have told us you deliver. If you become a client we collect what is needed to prepare your registration: business details, ABN or ACN, key personnel, addresses, insurances, qualifications, worker screening details and the other material the NDIS Commission requires for an application. Some of that is sensitive information within the meaning of the Privacy Act, and we collect it only with your consent and only for the registration you have engaged us for.

2.2What your browser tells us. Every visit records a small amount of technical context: device type, browser, operating system, screen and window size, language, timezone and approximate connection speed. We also record which pages you viewed, in what order, how long you spent on each and how far down each one you scrolled, and how many times you have visited before. If you complete a form, we record how long you spent on it, how long before you started filling it in, and the order you completed the fields — this is used to tell genuine enquiries from automated submissions and to find parts of the form people get stuck on. We also record which buttons and links you click, which questions you open, how far you watch a video, the approximate location your connection resolves to (country, state and city, not your address), and page-speed measurements.

2.3Where you came from. If you arrive from an advertisement or a search result, the link carries identifiers that tell us which ad or campaign it was. These include Google Ads identifiers (gclid, gbraid, wbraid), Microsoft Advertising (msclkid), Meta (fbclid), and identifiers used by TikTok, LinkedIn, X, Reddit, Pinterest and Impact, together with any campaign tags on the link such as utm_source, utm_medium and utm_campaign. We also record the page you landed on and the website that referred you.

We record the information in 2.2 and 2.3 as you browse, against a random identifier stored in a cookie on your device (not your name or contact details). It is held in our own database, run for us by the providers named in clause 5 (see clause 6 on overseas storage). If you later complete a form, we link that browsing record to your enquiry using a one-way hash of your email address, so we can see which pages and advertisements led to it. We do not record anything you type into a form until you submit it, and we never record your IP address.

3Why we collect it

We collect personal information for these purposes and no others:

• To respond to your enquiry and tell you which registration pathway applies to you, what it costs and how long it takes.
• To provide the services you have engaged us for, including preparing documentation and supporting you through audit.
• To meet our own legal and record-keeping obligations.
• To understand which advertising and which pages actually produce enquiries, so that we spend less on advertising that does not work.
• To detect and block automated and fraudulent form submissions.
• To improve the website, including finding the points at which people abandon a form.

We do not sell personal information. We do not disclose it to data brokers. We do not use it to make automated decisions that have a legal or similarly significant effect on you.

4Cookies and browser storage

This website stores a small amount of data in your browser using cookies, localStorage and sessionStorage. It is used to remember the advertisement or search that brought you here, to count your visits, and to assemble the page-by-page record described in clause 2.2.

4.1We also run the Meta pixel, a small script from Meta Platforms. It records that a page was viewed and that an enquiry form was submitted, and it sets two cookies of its own (_fbp and _fbc) which identify your browser to Meta. We use it to measure which advertisements produce enquiries and to reach people who have visited the site before. It does not record what you type into a form.

4.2Our own cookies: eu_vid, a random identifier kept for up to 400 days so we can recognise a returning browser, and eu_sid, which marks a single visit and expires after 30 minutes of inactivity.

4.3We also use Google Analytics and the Google Ads tag (Google), Microsoft Advertising's UET tag, the LinkedIn Insight Tag, Microsoft Clarity and MoEngage. Each sets its own cookies and records page views and the actions described in 2.2 so we can measure which advertising works. Clarity records how pages are used (mouse movement, clicks and scrolling) to help us improve them; it does not record what you type into form fields. MoEngage records page views and visits so we can understand engagement with our website.

4.4When you click through to checkout, the link to our payment page carries the identifier in 4.2 and the campaign that brought you here, so a purchase can be matched to the visit that led to it.

You can block or delete this at any time through your browser settings, and you can browse in a private window to prevent it being stored at all. The website works normally either way — nothing on it requires you to accept storage, and declining it does not change what you are shown or what you are charged.

5Who we share it with

We disclose personal information to the service providers we use to run the business. Each is bound by its own contractual obligations to us and may use the information only to provide its service.

• Close (Elastic Inc., United States) — our customer relationship management system. Enquiries and client records are held here.
• Kajabi (Kajabi LLC, United States) — marketing automation, course delivery and payments for our programs.
• Vercel (Vercel Inc., United States) — hosting for this website.
• Google (Google LLC, United States and Ireland) — advertising measurement and Google Business Profile reviews.
• Meta Platforms (Meta Platforms Inc., United States and Ireland) — advertising measurement, including the Meta pixel described in clause 4.1.
• Microsoft (Microsoft Corporation, United States) — advertising measurement (UET) and Clarity.
• LinkedIn (LinkedIn Corporation, United States) — advertising measurement.
• MoEngage (MoEngage Inc., United States) — website engagement measurement, described in clause 4.3.
• Neon (Neon Inc., via Vercel) — the database that holds the browsing records in 2.2 and 2.3.
• Professional advisers, and any person or body we are required to disclose to by law.

5.1Where we report a conversion back to an advertising platform so that we can measure which advertisement produced an enquiry, we send your email address and phone number in a hashed form. Hashing is one-way: the platform can match it against an account it already holds, and cannot read your email address or number from it. This includes Google Ads enhanced conversions and Meta's Conversions API, which receive your email address and phone number hashed in this way, together with the advertising identifiers in 2.3 and, for Meta, your browser's user agent and IP address at the time of the enquiry (sent to Meta, not stored by us).

5.2We do not disclose your information to an approved quality auditor, the NDIS Commission or any other third party involved in your registration unless you ask us to or you have authorised us to act for you.

6Information sent overseas

Several of the providers listed in clause 5 are based outside Australia, principally in the United States and the European Union. Using them means your personal information is stored or processed overseas.

Under Australian Privacy Principle 8 we take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles, and in general we remain accountable to you for how they handle it. We do that through the contractual terms we accept with each provider and by choosing providers with recognised security practices. We do not disclose your information to an overseas recipient for any purpose other than those listed in clause 3.

7Marketing, and how to stop it

If you give us your contact details through an enquiry form, we will contact you about NDIS registration and the services you asked about. We may also send occasional material about related services, compliance changes and our community program.

Every marketing email carries an unsubscribe link that works, and unsubscribing takes effect immediately. You can also reply to any message, or use the privacy request form in clause 11, and ask to be removed. We will act on that request whether or not it is worded as an unsubscribe.

Opting out of marketing does not affect messages we need to send you about a service you have purchased.

8How long we keep it

We keep client records, including the personal information in them, for seven years after our engagement with you ends, to meet our business, tax and legal record-keeping obligations and to resolve any disputes. We keep other personal information only for as long as we need it for the purposes described in this policy. When we no longer need personal information, we take reasonable steps to destroy or de-identify it.

9Keeping it secure

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The website is served only over an encrypted connection, access to our systems is restricted to the people who need it, and credentials are held in managed secret storage rather than in documents or code.

No system is perfectly secure. If an eligible data breach occurs we will respond under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, which includes notifying you and the Office of the Australian Information Commissioner where the scheme requires it.

10Access, correction and deletion

10.1You may ask for access to the personal information we hold about you, under Australian Privacy Principle 12. We will respond within a reasonable period and will not charge you for making the request. There are limited circumstances in the Privacy Act in which access may be refused; if that applies we will tell you in writing why, and how to complain about it.

10.2You may ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, under Australian Privacy Principle 13. We will correct it, and if we have already disclosed it we will tell the recipient on request.

10.3You may ask us to delete the personal information we hold about you. We will do so unless we are required to keep it — see clause 8 — and we will tell you which information we have kept and why.

10.4You may deal with us anonymously or under a pseudonym where it is lawful and practicable. For a general question about registration, it is. For preparing an application to the NDIS Commission, it is not.

11Complaints and contact

If you think we have mishandled your personal information, tell us first. Use the privacy request form below or write to us at 274 Victoria Street, Darlinghurst NSW 2010. The same form is how to ask for access to, correction of or deletion of your information. We will acknowledge your complaint and respond within a reasonable period, normally 30 days.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au, by phone on 1300 363 992, or by writing to GPO Box 5218, Sydney NSW 2001.

12Changes to this policy

We may update this policy as our services and the systems behind them change. The current version is always the one published here, and the date it was last updated is shown at the top of this page. Where a change is significant we will say so rather than relying on you to notice.