PRIVACY POLICY

Thomas Hopper and Partners – Privacy Policy

Thomas Hopper and Partners and its related entities (Us, Our or We) understands the importance of the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (Privacy Act) and are committed to ensuring the privacy of your Personal Information. This Privacy Policy is an explanation of how We manage your Personal Information. Our specific legal obligations in respect to the collection and handling of Personal Information are outlined in the Privacy Act.


“Personal Information”, as defined in the Privacy Act, is information, or an opinion, in any form, and whether true or not, about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. We will only use the information that We collect about you lawfully. Generally We will only collect Personal Information where the information is necessary for Us to perform one or more of Our functions or activities. In this context, "collect" means gather, acquire or obtain by any means, information in circumstances where the individual is identifiable or identified.


By providing your Personal Information to Us, you consent to the collection, use and disclosure of that Personal Information in accordance with this Privacy Policy (except where We are required or authorised by law to collect, use or disclose that information without your consent, including under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) as described under " PERSONAL INFORMATION COLLECTED FOR AML/CTF COMPLIANCE " below). 


If you do not agree to this Privacy Policy, please do not provide Us with Personal Information.


We may amend this Privacy Policy from time to time. The current version of this Privacy Policy is available on the following site: www.thpartners.com.au and you may request a copy by contacting Us at info@thpartners.com.au or 02 9929 4177.


WHAT TYPES OF PERSONAL INFORMATION DO WE COLLECT?

The amount and type of Personal Information that We collect and hold about you depends on the dealings you have with Us and may include your name, age, date of birth, contact details such as phone, fax, email address and mobile phone number, physical address and delivery address, email address, tax file number, financial affairs including bank account and credit card details, product interests, company details, details of your contact person, the names of all directors, officers and senior management staff, the names of employees, the name of the contact person at your bank or financial institution, along with general personal and financial information such as the type and quantity of assets that you purchase or own, records of your communications and interactions with Us and the ATO and behaviour relating to transactions, products, services and activity with Our services.


Where We provide a designated service under the AML/CTF Act, the Personal Information We collect may also include the ‘know your client’ information described under "PERSONAL INFORMATION COLLECTED FOR AML/CTF COMPLIANCE" below.


We may not be able to provide Our services without your Personal Information.


HOW PERSONAL INFORMATION IS COLLECTED AND HELD

We may collect your Personal Information, and that of other persons using Our products or services, from your interactions and transactions with Us including:

  • when we verify your identity;
  • when you make a telephone or videoconference communication;
  • when you make an email communication;
  • when you complete a transaction with Us;
  • when you, or the business that you work for, engage Us to provide services, including when you supply the ‘know your client’ information in response to Our request;
  • when you register or subscribe to Our services including Our website and mailing list;
  • when you visit Our office as a part of the services we provide;
  • when you visit certain parts of Our website where you are invited to provide content, submissions and suggestions, or visitorship data;
  • when you provide information via Our LinkedIn pages;
  • when you apply for a job with Us or seek to become a service provider or seek Us to provide you services;
  • when you contact Our partners, suppliers, associates or others within the group;
  • from third parties, including public sources, information service providers, credit reporting agencies or anyone authorised to act on your behalf.


We may also collect Personal Information by other means and will take all reasonable steps to inform you if and when We do.

We collect Personal Information in a number of ways, including:

  • in person;
  • over the telephone including by way of monitoring and recording telephone calls;
  • in virtual meetings conducted via video conference including by way of recording and transcribing those meetings;
  • using electronic or biometric identity verification technology; 
  • through Our website;
  • on hard copy forms;
  • through written communications including letters, facsimiles and emails; and
  • from third parties, including:
  • verification and screening providers (such as First AML);
  • publicly available sources, information service providers, credit reporting agencies or anyone authorised to act on your behalf;
  • agents, employees, subcontractors, suppliers and services providers (including any service provider such as a law firm or other accounting firm that has referred you to Us); and
  • Our partners and related entities.


Where We use electronic or biometric identity verification, We may also use third-party verification providers (such as First AML) to verify identity information, assess whether a person matches an identity document, conduct liveness or fraud checks, and provide verification outcomes. Biometric information is sensitive information. Where We collect it, We will do so only as permitted by the Privacy Act, including with your consent where required.


Please note that:

  • before We can provide any service, We will ask for your consent to collect and use the information needed. Consent is not required for information that We are legally required to collect, including under the AML/CTF Act;
  • if you don't provide Us with all required information, We may not be able to provide you with the service requested; and
  • there may be times when it is lawful and practical for you to work with Us anonymously; however, by doing so, We may not be able to provide you with the service requested. Anonymity is not available where We are required by law to identify you, including where We provide a designated service under the AML/CTF Act.


If it is practical We will notify you of the matters listed below at the time of collecting any Personal Information:

  • the main reason that We are collecting Personal Information (this reason will be the Primary Purpose);
  • other related Uses or Disclosures that We may make of the Personal Information (Secondary Purposes);
  • Our identity and how individuals can contact Us, if this is not obvious;
  • that individuals can access the Personal Information that We hold about them;
  • that individuals should contact Us if they wish to access or correct Personal Information collected by Us or have any concerns in relation to Personal Information;
  • where applicable, any law that requires the Personal Information to be collected (for example, the AML/CTF Act);
  • the consequences (if any) for the individual if all or part of the Personal Information is not provided to Us.


Where it is not practicable for Us to notify individuals of all of the collection information before the collection of Personal Information, We will ensure that individuals are notified of the collection information as soon as possible after the collection. We will provide "post collection notification" in those circumstances where it is not practicable to notify individuals about the collection of their Personal Information before it is collected. Notification does not extend to disclosures that We are prohibited from notifying you of under the AML/CTF Act (see "PERSONAL INFORMATION COLLECTED FOR AML/CTF COMPLIANCE" below).


We also collect general statistical information from Our website, such as the number of visitors to the website, the number of pages viewed, the date, time and duration of visits and how the visitor came to the website. We may also collect Internet Protocol (IP) addresses and internet browser type. This information will not identify you. For more information, please read the section on cookies below.


WEBSITE ANALYTIC, SESSION AND COOKIE TOOLS

We use a range of tools provided by third parties, including Google, Bing and other service providers including Our web hosting company to collect or view website traffic information and site visitorship data. These sites and providers have their own privacy policies. We also use cookies and session tools to improve your experience when accessing Our website. We use the information to maintain, secure and improve Our website and to enhance your experience when using it.


Site visitorship data is information about the way a website is used that is not associated with an individual's identity. We use anonymous data regarding online behaviour to better understand how people use Our services. To that end, We may use aggregated, anonymous online traffic behaviour, along with information from third parties to track usage trends and thereby improve Our services. We may also use this aggregated, anonymous information to develop reports that We may share with third party marketing partners and affiliates. The kind of information We may collect includes:

  • the date and time you access the services;
  • your internet service provider, mobile carrier, or data services provider;
  • your Internet Protocol (IP) address;
  • the pages you visit;
  • the links you click;
  • the features you use;
  • how and when you interact with the services;
  • the content, images and advertisements you select; and
  • how you arrived at the products and where you go when you leave.


Most site visitorship data is collected using data collection tools such as web beacons, cookies, embedded web links and other software (together "Data Collection Tools"). Data Collection Tools are typically small data files or software that are sent to your browser and stored on your computer or mobile device. Most browsers and display software can be set to inform you when Data Collection Tools are being used or other tracking software is being sent to your computer or Personal Communication Device. They also provide you with the option of refusing such Data Collection Tools. However, refusing to allow the use of Data Collection Tools may, in some cases, preclude you from using, or negatively impact the display or function of, certain areas or features of Our services, including preventing you from acquiring services from Us.


WHY WE COLLECT PERSONAL INFORMATION

We collect, hold, use and disclose your Personal Information so that We may:

  • facilitate Our client due diligence, client onboarding, anti-money laundering and counter-terrorism financing (AML/CTF), 'know your client' and other business acceptance processes (see "PERSONAL INFORMATION COLLECTED FOR AML/CTF COMPLIANCE" below);
  • verify your identity;
  • provide you with the services you purchase or obtain from Us;
  • provide you with information about the services;
  • respond to your enquiries, requests for information or complaints;
  • process data you provide;
  • conduct, monitor and analyse Our business and internal operations (including staff management);
  • send you information you order or request;
  • facilitate Our marketing and promotional activities;
  • open, maintain and administer client files; 
  • comply with Our legal and regulatory obligations, including client due diligence, ongoing client monitoring, risk assessment, reporting and record keeping under the AML/CTF Act and the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (AML/CTF Rules) (see "PERSONAL INFORMATION COLLECTED FOR AML/CTF COMPLIANCE" below); and
  • any other purpose to which you have consented or which is required or permitted by law.


If permitted by law, We may disclose information collected about you as an asset of Our related entities in conjunction with the purchase and potential purchase of any of Our related entities or a portion of their assets. Any Personal Information that is disclosed to such a third party will remain subject to the protections in the APPs.


PERSONAL INFORMATION COLLECTED FOR AML/CTF COMPLIANCE

Two of Our related entities, THP Services Pty Ltd and M Point Superannuation Services Pty Ltd (Related Entities), are reporting entities under the AML/CTF Act and the AML/CTF Rules in relation to the designated services the Related Entities provide. The Related Entities are required by law under the AML/CTF Act to collect and verify certain Personal Information, and may be prohibited from providing designated services if they cannot do so.


Where required to comply with the AML/CTF Act and AML/CTF Rules, the Related Entities may collect, hold, use and disclose Personal Information for purposes including client due diligence, ongoing client monitoring, risk assessment, reporting to regulators (including to the Australian Transaction Reports and Analysis Centre (AUSTRAC)), and record keeping. In particular, the Related Entities may collect ‘know your client’ information as required by the AML/CTF Act, including:

  • the identity and contact details of a client;
  • information to support the verification of a person's identity, including government identifiers, government identity documents and expiration dates of those government identification documents, and, where electronic verification is used, images of identity documents, facial images, liveness information and biometric information;
  • the identity of any person on whose behalf a client is receiving the service;
  • the identity of any person acting on behalf of a client, including their authority to act;
  • if the client is not an individual, the identity of any beneficial owners;
  • whether a client, a beneficial owner or any person acting on their behalf is a politically exposed person or a person designated for targeted financial sanctions;
  • information regarding source of wealth and source of funds;
  • information as part of sanctions and adverse media checks;
  • the nature and purpose of the business relationship or transaction; and
  • information regarding any other matter specified in the AML/CTF Rules.


Personal Information is collected only where reasonably necessary to comply with the Related Entities’ legal obligations for AML/CTF purposes and only in connection with matters where a designated service is, or is reasonably likely to be, provided. Not all engagements require the collection of Personal Information for AML/CTF purposes.


Where Personal Information is collected for AML/CTF purposes, We do not retain copies of full identity documents (such as passports or driver licences). Instead, We retain only the specific information required by law, such as relevant identification details, the type of document relied upon, verification outcomes and AML/CTF risk assessments. 


However, where required by law, or where reasonably necessary having regard to ongoing AML/CTF risks, the verification method used, auditability, fraud risk, disputes, regulatory enquiries, enhanced client due diligence, suspicious matter assessment or ongoing client due diligence, We may retain limited copies or images of identity documents, facial images or related verification artefacts to ensure compliance with the AML/CTF Act and AML/CTF Rules.


The Related Entities may use or disclose Personal Information collected for AML/CTF purposes where required or authorised by law, including under the Privacy Act, the AML/CTF Act or the AML/CTF Rules. This includes disclosure to AUSTRAC and other regulators, and to service providers that support Our AML/CTF due diligence processes.


Certain disclosures and restrictions on disclosure apply under the AML/CTF Act, including its secrecy and tipping-off provisions. In these circumstances the Related Entities are prohibited from notifying you of disclosures to AUSTRAC and may be prohibited from notifying you of disclosures to other government agencies or authorities.


Personal information collected for AML/CTF purposes is retained and destroyed as described under "HOW DO WE KEEP YOUR PERSONAL INFORMATION SECURE?" below, and access to and correction of that information is subject to the limits described under "ACCESS TO, AND CORRECTION OF, PERSONAL INFORMATION" below.


DIGITAL SERVICES

We provide information and services through a range of digital and online services including websites, email and social media profiles. Some information We collect, for example is not related to an individual. In many cases, the information relates only to a device or is of an aggregated or statistical nature, and We will have no way of knowing the identity of the user. In other cases, We may associate information about your use of Our digital services over time with your Personal Information, for example, when on any occasion you have logged in, followed a link sent to you by email, or We have otherwise been able to identify you.


HOW DO WE USE AND DISCLOSE PERSONAL INFORMATION?

We use Personal Information to process orders and reservations made by you, provide services to you or to contact you about services that are relevant to you or to send you information that may be of interest to you. We will not use Personal Information without taking reasonable steps to ensure that the information is accurate, complete and up to date.

Unless otherwise disclosed during collection, We will not provide any Personal Information to any third party for any purpose whatsoever, other than:

  • in the event of a sale of Our business or any of Our related entities (then to that purchaser);
  • to enable Us or Our suppliers, service providers or partners to fulfil any service that you have requested from Us; 
  • to a regulator, including the ATO, OSR, ASIC or AUSTRAC;
  • where required or authorised by law, including under the Privacy Act, the AML/CTF Act or the AML/CTF Rules (including disclosures that We are prohibited from telling you about);
  • to a verification and screening provider (such as First AML);
  • to a law firm or accounting firm We have entered into a reliance arrangement with in accordance with the AML/CTF Act, for the purpose of sharing Personal Information collected for AML/CTF purposes with that firm; or
  • to one of Our related entities, partners, suppliers or service providers.


Please note, if you provide your credit card information to Us in order to conduct an e-commerce transaction on the website or otherwise, We will provide your information to participating merchants in order to process that transaction. We are not responsible for how that information may be used by participating merchants.


SHARING OF PERSONAL INFORMATION AND CROSS-BORDER DISCLOSURE

We may share your Personal Information with third parties where appropriate for the purposes set out in this Privacy Policy, including:

  • Our verification and screening provider (such as First AML);
  • Our related entities;
  • where you are an employee or service provider of Our client, We may share information collected about you in respect to the services We provide to the client with them;
  • merchants for payment processing;
  • Our service providers, suppliers or partners to fulfil a service that you have requested from Us;
  • service providers engaged to assist with services including sales, distribution, logistics and delivery, data processing and storage, data analysis, information broking, credit reporting, online computing, printing, contact centre, legal, accounting, business consulting, marketing, research, auditing, archival, delivery, security, investigation, mailing services and analysis; and
  • other persons, including government agencies, regulatory bodies, law enforcement agencies and courts and as otherwise required or authorised by law.


While we aim to use service providers and suppliers located in Australia, some of Our service providers and suppliers providers may receive, access, process, host or store your information in overseas locations. This includes the United Kingdom, United States of America, India and the Philippines. This does not apply to identity verification data collected through First AML, Our verification provider for AML/CTF purposes, which is hosted in Australia (unless We notify you otherwise).


We take reasonable steps to ensure that all Our service providers agree to protect the privacy and security of your Personal Information, and use it only for the purpose for which it is disclosed, subject to their obligations of compliance to the Privacy Act. 


ACCESS TO, AND CORRECTION OF, PERSONAL INFORMATION

You are entitled to access your own Personal Information being held by Us. This information is generally provided on request. So that We can respond to your request quickly and efficiently, if at any time you want to know what Personal Information We hold about you, correct such information or have any questions or complaints you are welcome to contact Us by:


We aim to respond to most requests for access within 30 days subject to some exceptions permitted by law. We may however charge a fee to cover Our reasonable costs of locating the information and providing it to you.


If you ask Us to correct Personal Information that We hold about you, or if We are satisfied that the Personal Information We hold is inaccurate, out of date, incomplete, irrelevant or misleading, We will take reasonable steps to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up-to-date, complete, relevant and not misleading. If We correct Personal Information about you, and We have previously disclosed that information to another agency or organisation that is subject to the Privacy Act, you may ask Us to notify that other entity. If so, We will take reasonable steps to do so, unless this would be impracticable or unlawful. Where We decide not to make a requested correction and you disagree, you may ask Us to make a note of your requested correction with the information.


Access to, and correction of, Personal Information may be limited or refused where required or authorised by law, including where providing access or information would breach Our obligations under the AML/CTF Act, such as its secrecy or tipping-off provisions. In such circumstances We may be unable to provide reasons for refusal.


In most cases, We expect that complaints will be investigated and a response provided within 30 days of receipt of the complaint. If the matter is more complex and Our investigation may take longer, We will contact you and tell you when We expect to provide Our response.


HOW DO WE KEEP YOUR PERSONAL INFORMATION SECURE?

We hold Personal Information in a number of ways, including electronically, in hard copy form, in electronic databases and files, both at Our own premises and with the assistance of Our service providers including at archive facilities and external data management facilities. We implement a range of measures to protect the security of that Personal Information. The steps We take to secure Personal Information include website protection measures, security restrictions on access to Our premises and computer systems together with Our service provider's facilities. The Personal Information we hold will be held securely in accordance with Our internal policy and the law. We take steps to protect the Personal Information We hold against loss, unauthorised access, use, modification or disclosure, and against other misuse. We also take measures in respect of destroying or de-identifying Personal Information that is no longer needed for any lawful purpose. Personal Information collected for AML/CTF purposes, including ‘know your client’ information, is retained only for the period required by law). Once it is no longer required for AML/CTF or other permitted purposes, it is securely destroyed in accordance with applicable legal requirements.


We cannot guarantee, in every circumstance, the security of the Personal Information you provide on the website or via any electronic form of communication with Us. All incoming encrypted information is routed through Our firewall, which serves as a gatekeeper for Our system. Only data containing the correct authorisation is permitted past the firewall. Attempts to pass the firewall are constantly monitored for suspicious activity.


Where data is held overseas or by third parties, We require third parties to store such data in restricted access premises and provide appropriate protection against unauthorised disclosure. As a minimum security requirement, password authentication is required to access those databases in all cases.


COMPLAINTS

If you think We have breached the Privacy Act, or you wish to make a complaint about the way We have handled your Personal Information or a request from you to access or correct your Personal Information, you can contact Us using the details set out below. Please include your name, email address and telephone number and clearly describe your complaint.:


Upon receipt of a complaint, We will acknowledge receipt and indicate the timeframe that you can expect a response. We will endeavour to investigate and respond to the complaint as quickly as possible, but if the matter is complex and Our investigation may take longer, We will let you know when We expect to provide Our response.


If your complaint relates to Personal Information held or disclosed for AML/CTF purposes, please note that We may be unable to confirm or provide details of certain disclosures (including to AUSTRAC) because of the secrecy and tipping-off provisions of the AML/CTF Act.


If you are unhappy with Our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at enquiries@oaic.gov.au or on 1300 363 992. More information is available on the OAIC’s website at https://www.oaic.gov.au/.


Our Privacy Policy was last updated on 21 October 2026