Privacy Policy

1. About This Policy

mySMB Legal Pty Ltd ACN 687 496 886 (mySMB Legal, we, us or our) is an incorporated legal practice providing legal services to small and medium businesses across Australia. We respect your privacy and take our obligations to protect it seriously.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit our website, enquire about or engage us for legal services (including through our subscription plans, fixed-fee and bespoke services), or otherwise deal with us.

mySMB Legal works alongside mySMB.com, an affiliated platform supporting small and medium businesses. mySMB.com has its own privacy policy, which applies to personal information it collects through its platform. This Privacy Policy applies to personal information collected and held by mySMB Legal. Information you give us to obtain legal services is confidential to mySMB Legal and is not shared with mySMB.com except as described in section 5 or with your consent.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). As solicitors, we are also bound by professional duties of confidentiality under the Legal Profession Uniform Law and the Australian Solicitors’ Conduct Rules.

2. Personal Information We Collect

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

If you visit our website, make an enquiry or engage us for legal services, we may collect the following information:

• your name, contact details, business name and ABN, and account and login information;
• your role, organisation, industry, business stage and the type of legal support you are looking for;
• information about your subscription plan, fixed-fee quotes, billing and transaction history;
• event and webinar registration and attendance information;
• questions, prompts, documents and other content you submit through our Legal Agent offering, and the outputs generated and reviewed in response;
• information about how you use our website, such as your IP address, device and browser type and pages visited (see section 8);
• records of your communications with us, including enquiries, booking requests and feedback.

If you engage us for legal services (under a subscription plan, fixed fee or bespoke arrangement), we may also collect:

• your name, contact details and identity information, including identity documents and government related identifiers (such as driver’s licence or passport details) where required to verify your identity or comply with the law;
• information about your matter, including facts, instructions, documents and correspondence you provide to obtain legal advice or services;
• information about other individuals connected with your matter, such as counterparties, opposing parties, directors, shareholders, beneficial owners, employees, contractors or family members, including information collected to conduct conflict checks;
• sensitive information, where relevant to your matter (for example, health information in an employment or workplace matter);
• customer due diligence information where we provide a designated service under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), including beneficial ownership, source of funds and source of wealth information;
• costs agreement and costs disclosure, billing, payment and bank account information; and
• file notes, records of communications and documents relating to your matter.

Information we hold in connection with legal services is subject to our professional duties of confidentiality and, where applicable, legal professional privilege. If you give us information about another individual (for example, an employee, business partner or counterparty), you should make sure you are entitled to do so and, where appropriate, let them know that you have provided it to us.

Payment-card details may be collected and processed by our payment providers rather than stored directly by us.

If you apply to work with us, or work with us as a contractor or consultant lawyer, we collect information such as your CV, qualifications, practising certificate details and referees’ details.

3. How We Collect Personal Information

Where reasonably practicable, we collect personal information directly from you, for example when you complete a form on our website, book a call, sign up to a plan, use The Legal Agent, email or speak with us, or give us instructions and documents. We may also collect personal information from mySMB.com (where you have asked to be referred to us or agreed to it sharing your details with us); your business, its directors, employees or advisers (such as your accountant); other parties to your matter and their representatives; identity verification providers; and publicly available sources such as ASIC, ABN Lookup and the internet.

Where it is lawful and practicable, you can deal with us anonymously or using a pseudonym, for example when making a general enquiry. However, we cannot act for you without knowing who you are, because we must verify your identity, check for conflicts of interest and, in some cases, meet our AML/CTF obligations.

If you do not provide the personal information we ask for, we may not be able to provide our services or act on your matter.

4. How We Use Personal Information

We use personal information for the following purposes.

If you visit our website, make an enquiry, subscribe to a plan or use our Legal Agent offering, to:

• create and administer accounts;
• respond to enquiries, prepare proposals and fee quotes, and provide our services;
• manage subscriptions, purchases and payments;
• operate our Legal Agent offering, including processing your questions using AI tools and enabling a mySMB Legal lawyer to review each output before it is provided to you;
• personalise content and let you know about legal resources, templates or services relevant to your business;
• manage security and prevent misuse;
• communicate with you;
• improve our products and services;
• manage client and referral relationships;
• comply with legal and regulatory obligations;
• send marketing communications where permitted.

If you engage us for legal services, to:

• verify your identity and conduct conflict checks before and during an engagement;
• provide legal advice and services, act on your instructions and manage your matter;
• communicate with you and, on your behalf, with counterparties, their advisers and other third parties involved in your matter;
• conduct customer due diligence, ongoing monitoring and reporting, and meet our other obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth);
• prepare costs agreements and disclosures, issue invoices and receive payments;
• meet our professional, ethical and regulatory obligations, including obligations under applicable legal profession legislation and professional conduct rules;
• maintain files, file notes and records of our services;
• manage risk, quality assurance, professional indemnity insurance, complaints and disputes.

We may also use personal information for a related purpose where you would reasonably expect us to do so, where you have consented, or where otherwise permitted or required by law.

Where appropriate, we may provide a separate collection notice at or around the time information is collected.

Some information you provide to us may include sensitive information. We only collect sensitive information with your consent, or where otherwise permitted or required by law.

5. Sharing Personal Information

We may share personal information with:

• our lawyers, employees and authorised contractors (including consultant lawyers), who are bound by confidentiality obligations;
• service providers that help us operate our practice, such as IT, practice management, document management, e-signature and identity verification providers;
• hosting, cloud, security, payment, communications, AI technology, analytics and support providers;
• mySMB.com, only to the extent needed to administer your subscription or a referral, and never including confidential information about your matter without your consent;
• barristers, experts, other law firms (including agents in other states or overseas), courts, tribunals and other parties to your matter, where needed to carry out your instructions;
• professional advisers, professional indemnity insurers and auditors;
• regulators (including the Law Society of NSW, the Office of the Legal Services Commissioner and AUSTRAC), courts, law-enforcement agencies or other authorities where required or permitted by law;
• a purchaser or successor in connection with a business sale or restructure.

We only share information where it is reasonably required for the relevant purpose or otherwise permitted or required by law.

We do not sell personal information.

Where we are required by law to report information to AUSTRAC or another authority, the law may prevent us from telling you that a report has been made.

If you ask us to introduce you to another professional (such as an accountant, financial adviser or another law firm), we will only share the information reasonably needed for that introduction, with your consent.

Our website and services may link to or integrate with third-party services (for example, booking, e-signature or payment tools). Those services may handle information under their own terms and privacy policies.

Where we disclose personal information to a service provider, we take reasonable steps appropriate to the circumstances to protect that information and support compliance with applicable privacy requirements.

We are not responsible for the independent privacy practices of a third-party service that you independently choose to access or connect. This does not limit our own obligations in relation to personal information we collect, hold, use or disclose.

6. AI, The Legal Agent and Automated Decisions

We use AI-enabled tools to support the delivery of our legal services, including the Legal Agent, document drafting and review, research and administrative tasks. AI tools support our lawyers; they do not replace them. Every output from the Legal Agent is reviewed by a mySMB Legal lawyer before it is provided to you, and our lawyers remain responsible for the legal services we provide.

We do not use computer programs to make decisions about you that could reasonably be expected to significantly affect your rights or interests.

If this changes, we will update this Privacy Policy to describe the kinds of personal information used and the kinds of decisions made, as required by the Privacy Act.

We only use AI providers that process information on our behalf, apply appropriate security controls and are contractually prohibited from using our clients’ information to train their models. We do not use confidential information about your matter to train AI models. We may use aggregated or de-identified information that does not identify you or your business, or reveal confidential matter information, to improve our services, templates and AI-enabled features.

To protect others’ privacy, please avoid including unnecessary personal information about other people in questions you submit to the Legal Agent.

7. Overseas Access and Storage

Some personal information may be accessed, stored or processed outside Australia (for example, where our cloud, email or AI providers store or process data, or where your matter involves overseas parties), including in the Philippines, the United States, the European Union, the United Kingdom, New Zealand and Singapore.

Overseas access is limited to what is reasonably required and is subject to appropriate privacy, confidentiality, security and access controls.

We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

8. Cookies and Marketing

We use cookies and similar tools to operate our website and online tools, remember preferences, support login and security features, understand how our services are used and improve performance and functionality.

You can manage cookies through your browser settings. Some functionality may not work properly if cookies are disabled.

We may use personal information to send information about our products, services, updates, events and, where you have opted in, relevant offerings from mySMB.com or our referral partners. We do this in accordance with the Spam Act 2003 (Cth).

You can opt out at any time by using the unsubscribe link, updating available preferences or contacting us.

We do not provide personal information to another organisation for its independent marketing without consent or another lawful basis.

We may still send necessary administrative, account, service or security communications.

9. Security and Retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Our safeguards may include encryption, access controls, multi-factor authentication, matter-level access restrictions, security monitoring, staff requirements and incident-response procedures.

No electronic system is completely secure. While we take reasonable steps to protect your information, you also play a role in keeping your account, password, devices and connected services secure.

If we become aware of a suspected data breach, we will assess and respond to it in accordance with our legal obligations. Where an eligible data breach occurs, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

We keep personal information for as long as reasonably necessary to provide the relevant product or service, manage our relationship with you, meet legal, professional, regulatory, accounting, security or recordkeeping obligations, or resolve complaints and disputes.

For client files, we generally keep records for at least seven years after a matter is completed, or longer where required by law (including AML/CTF record-keeping requirements) or where the nature of the matter requires it.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it.

Some information may remain after your subscription or engagement ends, including transaction records, security and audit records, client files, support and complaint records, backups and records required by law.

We may use aggregated or de-identified information for analytics, reporting, research, service improvement and product development.

10. Access, Correction and Complaints

You can ask to access or correct personal information we hold about you.

We may need to verify your identity before responding.

We will respond within a reasonable period. We may refuse access or correction where permitted by law, including where providing access would prejudice legal professional privilege, breach a duty of confidentiality we owe to another person (such as another client), or unreasonably affect the privacy of others. If that happens, we will generally explain why and tell you about available complaint options.

If you have a concern about how we handle personal information, please contact us and provide enough information for us to investigate.

We aim to respond within 30 days. If we need more time, we will let you know.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

Complaints about the professional conduct of our lawyers may also be made to the Office of the NSW Legal Services Commissioner.

11. Changes and Contact

We may update this Privacy Policy when our practices, services or legal obligations change.

The current version will be available on our website.

Where a change is material, we will take reasonable steps to notify affected individuals.

Privacy questions, requests and complaints can be directed to:

mySMB Legal Pty Ltd
Attention: Privacy Officer
Level 12, 50 Carrington Street
Sydney NSW 2000

Email: legal@mysmb.com

Version 1: 20 October 2026