Legal

Australia Privacy Policy

Purpose

We are committed to protecting privacy and confidentiality in accordance with the Australian Privacy Principles (‘APPs’), and Privacy Act 1988 (Cth) (‘Privacy Act’), and it is one of our prime responsibilities, that any personal or sensitive information provided to us is not used for any other purpose than that of which is intended and expected. This Privacy Policy describes our current policies and practices for collecting, handling, using and disclosing personal information. It also deals with how to complain about a breach of the privacy laws, how individuals can access the personal information we hold about them and how to have that information corrected.

Scope

This Privacy Policy applies to Visory Pty Ltd (ABN 47 643 368 861) and its affiliated entities, including its related bodies corporate (as that term is defined under the Corporations Act 2001 (Cth)) (‘Visory’) who are bound by the Australian Privacy Principles and Privacy Act 1988 (Cth) and will protect the personal information of individuals in accordance with the above.

What is Personal Information?

Personal information includes any information or opinion about an identified individual or an individual who can be reasonably identified from their information. The information or opinion will still be personal information whether it is true or not and regardless of whether Visory have kept a record of it.

We may collect personal information about the following individuals:

Clients, including natural persons, sole traders, partnerships, companies, trusts and trustees;
Our clients’ employees, contractors, suppliers and customers, whose information we handle when we provide bookkeeping, payroll, accounts payable and accounts receivable services to our clients;
Visitors to our websites, and people who contact us or subscribe to our updates;
Prospective clients;
Service providers or suppliers;
Prospective employees, employees and contractors; and
Other third parties with whom we come into contact.

The above listed are referred to as ‘individuals’ in this policy.

The information that Visory seeks to collect will depend on the products or services that it provides. If an individual does not allow Visory to collect all of the information requested, Visory may not be able to deliver all of those services effectively.

If Visory receives unsolicited personal information that it could not have collected under the Australian Privacy Principles, it will destroy or de-identify that information as soon as practicable, where it is lawful and reasonable to do so.

What kind of Personal Information does Visory Collect and Hold?

Visory will not collect any personal information except when the individual has knowingly provided that information to us or authorised a third party to provide that information to us.

Visory may ask for various kinds of personal information to the extent this information is necessary for us to carry out the activities involved in providing you with products, services and information. The kinds of personal information include, but is not limited to:

Identification information, including but not limited to, name, address, contact details (including phone number, email address and other digital addresses and accounts), date of birth, tax file number, as well as information to verify an individual’s identity such as driver’s licence, birth certificate, or passport details;
Financial information, including but not limited to, an individual’s assets, liabilities, income, expenses, bank and direct debit details, superannuation and insurance details, and other financial details;
Employment and payroll information, including but not limited to, ABN/ACN, occupation, salary and pay rates, hours of work, leave, superannuation fund and member details, and employment history dates and records;
Screening checks (including but not limited to police, working with children, bankruptcy), reference checks, and other associated insights;
Transactional information of an individual’s dealings with us, including in relation to our products and services, making a record of queries or complaints an individual makes;
Insights, responses to surveys such as experiences and information about your activities, interest, and attitudes/views or other feedback expressed;
An individual’s device information such as device ID, geo-location, computer and connection information, statistics on page views, traffic to and from our websites, advertisement data, IP address and standard web log information; and
Any other personal information that may be required in order to facilitate an individual’s dealings with us.

We will not use identifiers assigned by the Government, such as a tax file number, Medicare number or provider number, for our own file recording purposes.

The collection of sensitive information is restricted by the Privacy Act. This includes information about religion, racial or ethnic origin, political opinions, membership of a trade union, criminal record, and sexual orientation. It also includes health information and biometric information. Generally, Visory only collects this sort of information if it is necessary to provide a specific product or service and the individual has consented to that collection.

What if an Individual chooses not to provide some Information?

Visory may be unable to provide its services if it does not have all the relevant information it requires to deliver such services.

For what purpose does Visory Collect, Hold, Use and Disclose Personal Information?

Visory collects, uses, holds and discloses personal information to facilitate the provision of its service offerings and interactions with individuals. This includes, but is not limited to:

Checking whether an individual is eligible for the product or service;
Assisting where online applications are not completed;
Providing the product or service;
Providing bookkeeping, payroll, accounts payable and accounts receivable services to our clients, which involves handling information about their employees, contractors, suppliers and customers on our clients’ behalf;
Replying to enquiries and arranging discovery calls;
Helping to manage or improve the product or service;
Complying with relevant laws, regulations and other legal obligations;
Preventing fraud, crime or other activity that may cause harm in relation to its products or services;
Assessing your prospective and ongoing suitability for employment or working arrangements with Visory, including conducting screening (including but not limited to police, working with children, bankruptcy) checks, reference checks, and other associated insights;
Conducting testing, surveys, research, insights and analytics (including through our third-party service providers);
Understanding and meeting your needs, including tailoring the content of our websites, emails, apps and social platforms to your preferences;
Conducting marketing activities in relation to our business, products, and service; and
As otherwise required in the running of Visory’s business.

What Service Offerings does Visory provide?

Visory understands the importance of a holistic service offering, whereby its clients can see their goals, needs and expectations being met. This approach encompasses providing products and services in relation to:

Bookkeeping
Payroll
Accounts payable
Accounts receivable
Visory Insights
Business Performance Partner sessions

How does Visory collect Personal Information?

Visory collects most of the personal information directly from the individual. This can be done electronically (see section “Does Visory collect personal information electronically?” of this policy for more information).

Visory also collects personal information about an individual from other areas of its business including sharing information amongst its subsidiaries and related parties or from third party organisations. This may happen without the individual’s direct involvement. For instance, Visory will collect personal information about an individual from:

Publicly available sources of information;
Our clients, when they give us information about their employees, contractors, suppliers and customers so that we can provide our services, including from the accounting, payroll and banking systems they connect to Visory (such as Xero, MYOB or QuickBooks);
The individual’s external representatives (including legal adviser, mortgage broker, executor, administrator, guardian, trustee, or attorney);
The individual’s employer;
Other organisations, who jointly with Visory, provide products or services to the individual;
Commercial information service providers, such as companies that provide fraud prevention reports;
Insurers, re-insurers and health care providers;
Third party information aggregators, and insight and analytics providers; and
Third parties providing screening (including but not limited to police, working with children, bankruptcy) checks, references, insights and other employment information in relation to prospective employees, employees, and consultants.

What Laws require or authorise Visory to collect Personal Information?

Visory is required or authorised to collect:

Certain identification information about an individual by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the Anti-Money Laundering and Counter-Terrorism Financing Rules;
An individual’s Tax File Number, if they choose to provide it, by the Income Tax Assessment Act 1936 (Cth).

How does Visory hold Personal Information?

Visory strives to maintain the relevance, reliability, accuracy, completeness and currency of the personal information we hold and to protect its privacy and security. Much of the information Visory holds about an individual will be stored electronically in secure data centres owned by either Visory or external service providers. Some of these data centres are located outside Australia (see “Does Visory disclose Personal Information overseas?”). Some information Visory holds about an individual will be stored in paper files and these files will be held in secure offsite storage.

Visory use a range of physical and electronic security measures to protect the security of the personal information they hold. For example:

Access to information systems is controlled through identity and access management;
Employees are bound by policies and procedures that require them to handle information in a secure manner.
All employees are required to complete training about information security; and
Regular monitoring and review of compliance with internal policies and industry best practice.

Visory takes reasonable steps to manage data destruction either physical or digital. These extend to our third parties who manage and hold our data.

Who does Visory disclose Personal Information to, and why?

Visory may provide personal information about individuals to external organisations. To protect personal information, Visory enter into contracts with their service providers that require them to handle personal information in a secure manner. These contracts oblige them to only use the personal information Visory disclose to them for the specific role they ask them to perform.

Generally, Visory disclose personal information to organisations that help them with their business. These may include:

Visory personnel, and related bodies corporate;
Our clients, where we handle information about their employees, contractors, suppliers or customers on their behalf;
Government agencies such as the Australian Taxation Office, when we lodge or report on our clients’ behalf;
Visory agents, contractors, third party suppliers, and external service providers (for example, mailing houses, technology service providers, analytics and insight providers);
Insurers, re-insurers and health care providers;
Payment systems operators (for example, merchants receiving card payments);
Other organisations, who jointly with Visory, provide products or services to the individual;
Financial services organisations, including banks, superannuation funds, stockbrokers, custodians, fund managers and portfolio service providers;
Debt collectors;
Visory professional advisers and agents;
An individual’s representatives (including their legal adviser, accountant, mortgage broker, executor, administrator, guardian, trustee, or attorney), or any other third parties authorised by an individual to receive personal information;
Fraud bureaus or other organisations to identify, investigate or prevent fraud or other misconduct;
HR advisors, including third parties used to provide candidate and employee screening checks, references, and insights;
External dispute resolution schemes;
Regulatory bodies, government agencies and law enforcement bodies in any jurisdiction;
Social media and digital platforms; and
Other companies in the event (including in initial discussions) of a corporate sale, merger, transfer, reorganisation, dissolution or similar event.

We may also disclose an individual’s personal information to others where:

Visory are required or authorised by law or where they have a public duty to do so;
The individual may have expressly consented to the disclosure or the consent may be reasonably inferred from the circumstances; or
Visory are otherwise permitted to disclose the information under the Privacy Act.

We may use and disclose your personal information for any of these purposes. We may also use and disclose an individual’s personal information for secondary purposes, which are related to the primary purposes set out above, or in other circumstances authorised by the Privacy Act.
Sensitive information will be used and disclosed only for the purpose for which it was provided (or a directly related secondary purpose), unless an individual agrees otherwise, or an exemption in the Privacy Act applies.

Does Visory disclose Personal Information overseas?

Visory may disclose an individual’s personal information to a recipient which is located outside Australia. This includes:

Any financial institution which the individual holds an account with overseas where they have given Visory permission to make enquiries on their behalf.
Other members of Visory that are located outside Australia, in some circumstances.
Our data hosting and other IT service providers;
Other third-party service providers.

Refer to APPENDIX A for the list of countries where these recipients may be located.

Some encrypted data may be backed up or mirrored in overseas jurisdictions by third parties. We will not send personal information to recipients outside of Australia unless:

We have taken reasonable steps to ensure that the recipient does not breach the APPs;
The recipient is subject to an information privacy scheme similar to the Privacy Act; or
The individual has consented to the disclosure.

Does Visory use or disclose Personal Information for Marketing?

Visory will use personal information to offer individuals products and services they believe may interest them but will not do so if the individual tells them not to. Visory may offer individuals products and services by various means, including mail, telephone, email, SMS or other electronic means, such as through social media or targeted advertising through Visory’s website.

Visory may also disclose an individual’s personal information to external companies who assist Visory to market their products and services to the individual, such as a mailing house.

If individuals do not wish to receive marketing offers from Visory, they can tell us at any time using the contact details below. Every marketing email we send identifies Visory and includes a working unsubscribe link, and we act on unsubscribe requests within five business days.

Does Visory collect Personal Information electronically?

Visory will collect information from individuals electronically, for instance through internet browsing, mobile or tablet applications.

Each time an individual visits one of Visory’s websites, Visory collects information about the individual’s use of the website, which may include the following:

The date and time of visits;
Which pages are viewed;
How users navigate through the site and interact with pages (including fields completed in forms and applications completed);
Location information about users;
Information about the device used to visit our website; and
IP addresses.

Visory uses cookies and similar technologies on its websites, as described under “Cookies and similar technologies” below.

Visory won’t ask individuals to supply personal information publicly over LinkedIn, Facebook, X, or any other social media platform that we use. Sometimes Visory may invite individuals to send their details to them via private messaging, for example, to answer a question. Individuals may also be invited to share their personal information through secure channels to participate in other activities, such as competitions.

Cookies and similar technologies

Our websites use cookies and similar technologies, such as tags, pixels and browser storage. A cookie is a small file that a website stores on your device. We group them as follows.

Strictly necessary. These keep the site working and remember your choices, such as the region you selected. They are always on.
Analytics. These help us understand how visitors use the site so we can improve it. We use Google Analytics, loaded through Google Tag Manager.
Marketing. These help us measure our advertising and follow up with people who contact us. We use Google Ads and HubSpot’s tracking code.

Google and HubSpot collect information such as your IP address, device and browser details, the pages you visit and how you arrived at the site. They may process this information outside Australia and New Zealand. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can block or delete cookies in your browser settings at any time, and doing so does not stop you using the site.

Where information collected through cookies is personal information, we handle it in accordance with this Privacy Policy.

Does Visory use automated decision-making or AI?

Visory uses software, including its own AI, Delphi, to help our team deliver bookkeeping, payroll, accounts payable and accounts receivable services. Delphi helps with the processing: for example, reading and coding invoices, receipts and bank transactions, matching payments, and preparing draft pay runs and reports. Our team reviews Delphi’s work, signs it off and stays accountable for it. Nothing is paid, lodged or sent without a person checking it, and every step leaves an audit trail.

To do this work, these computer programs use personal information contained in our clients’ financial and payroll records. The kinds of personal information used are:

names and contact details of our clients’ employees, contractors, suppliers and customers;
bank account and payment details;
pay rates, hours worked, leave, allowances and deductions, superannuation fund and member details, and tax file numbers of our clients’ employees; and
transaction, invoice and receipt details.

Visory does not make any decision that could reasonably be expected to significantly affect an individual’s rights or interests solely by the operation of a computer program.

Delphi does things that are substantially and directly related to the following kinds of decisions, which may affect individuals’ rights or interests. In each case a person on our team reviews and approves the work, and the decision is made by our client or by that person:

decisions about what our clients’ employees are paid in a pay run, including tax withheld, superannuation and leave, where Delphi prepares the draft pay run calculations;
decisions to pay suppliers, where Delphi codes and matches invoices for payment; and
decisions to follow up amounts owed to our clients, where Delphi prepares payment reminders.

Visory’s websites do not use automated decision-making about visitors. If you have a question about how we use Delphi, contact us using the details under “Key Contact”.

Keeping Information Secure

Visory uses security procedures and technology to protect the information we hold. To prevent misuse or unlawful disclosure of sensitive information, Visory has implemented internal policies which cover staff conduct, continuous training and monitoring of staff, and the inclusion of independence checks. If other organisations provide support services, we require these organisations to appropriately safeguard the privacy of the information provided to them.

Where the personal information we collect is no longer required, we may retain it in a secure manner for record keeping purposes, delete the information or permanently de-identify it in accordance with relevant laws and our internal records management policy.

Access to and correction of Personal Information

Under the Privacy Act, individuals have a right to seek access to information which we hold about them; although, there are some exceptions to this. They also have the right to ask us to correct information about them which is inaccurate, incomplete or out of date. To do so, they can contact Visory using the details under “Key Contact”. We will respond within a reasonable period, usually within 30 days.

We do not charge for receiving a request for access to personal information or for complying with a correction request. We do however reserve the right to charge you for all reasonable costs and outgoings specifically incurred in meeting your request for information. In processing an individual’s request for access to their personal information, a reasonable cost may be charged if they have requested access more than once within twelve months. This charge covers such things as locating the information and supplying it to them.

There are some circumstances in which Visory are not required to give individuals access to their personal information. If Visory refuse to give an individual access to or to correct their personal information, Visory will give them a notice explaining the reasons why, except where it would be unreasonable to do so. If we refuse an individual request to correct their personal information, the individual also has the right to request that a statement be associated with their personal information noting that they disagree with its accuracy. If Visory refuses an individual’s request to access or correct their personal information, we will also provide them with information on how they can complain about the refusal.

Notification

Due to the Privacy Amendment (Notifiable Data Breaches) Act 2017, Visory is legally required to notify affected individuals of any eligible data breaches. To comply with this legal requirement, Visory has implemented a Data Breach Response Plan in order to deal with actual or potential data breaches as well as the notification process to be followed when notifying affected individuals and the Office of the Australian Information Commissioner.

Resolving Privacy Concerns and Complaints

If an individual is concerned about how their personal information is being handled or if they have a complaint about a breach by Visory of the Australian Privacy Principles, they can contact Visory using the details under “Key Contact”.

Visory will acknowledge the complaint as soon as practical after receipt of the individual’s complaint. Visory will let the individual know if they need any further information from the individual to resolve their complaint.

We aim to resolve complaints as quickly as possible. We strive to resolve complaints within five business days, but some complaints can take longer to resolve. If a complaint is taking longer, we will let the individual know what is happening and a date by which they can reasonably expect a response.

If an individual is not satisfied with our response, under the Privacy Act they may complain to the Office of the Australian Information Commissioner about the way Visory handled their personal information.

The Commissioner can be contacted at:
Office of the Australian Information Commissioner
GPO Box 5288
Sydney NSW 2001
Phone: 1300 363 992
Online: www.oaic.gov.au/privacy/privacy-complaints

Key Contact

The individual can contact Visory by:
Calling 1800 847 679
Emailing [email protected]
Visiting www.visory.com.au
Writing to us at:
Disputes Manager
Visory Pty Ltd
Level 42, 600 Bourke Street
Melbourne VIC 3000

Changes to the Privacy Policy

We may change the way we handle personal information from time to time for any reason. If so, we will publish the updated Privacy Policy on our website and change the date below.

APPENDIX A

Visory may disclose an individual’s personal information to a recipient which is located outside Australia.

These recipients may be in New Zealand, United States, Canada

Updated 6 October 2026 and approved on legal review 14 October 2026. Previous version 31 August 2022.