Finchley & Kent Pty Ltd
Australian Financial Services Licence No. 555169
ABN 50 673 291 079
Level 63, 25 Martin Place, Sydney NSW 2000
T 1300 770 996  |  E info@finchleyandkent.com.au  |  W finchleyandkent.com.au

Policy Document
Version 2 | Effective 21 August 2026

1. Introduction

Finchley & Kent Pty Ltd (“Finchley & Kent”) ABN 50 673 291 079 (referred to as we, our, or us) is committed to the protection of Personal Information in accordance with the Privacy Act 1988 (Cth) (‘the Privacy Act’), including the Australian Privacy Principles (‘APPs’), and recognises the importance of ensuring the confidentiality and security of your Personal Information.

This Privacy Policy describes the way we collect, hold, use, and disclose Personal Information in accordance with the Privacy Act and the APPs. It is not intended to cover categories of Personal Information that are not covered by the Privacy Act or the APPs.

To the extent that it is necessary to do so, Finchley & Kent also complies with the requirements of the European Union General Data Protection Regulation (GDPR) where those requirements apply to our activities. Where an obligation imposed by the GDPR is more onerous than the equivalent obligation under Australian privacy laws, Finchley & Kent will comply with the applicable GDPR requirement.

All third parties (including clients, suppliers, sub-contractors, or agents) that have access to or use Personal Information collected and held by Finchley & Kent, must abide by this Privacy Policy and Collection Statement (‘Privacy Policy’). Finchley & Kent makes this Privacy Policy available free of charge, and it can be downloaded from our website: www.finchleyandkent.com.au.

For the purpose of this Privacy Policy:

• AML/CTF Obligations means our obligations as a reporting entity enrolled with AUSTRAC, as set out in the AML/CTF Legislation, including collecting your Personal Information to meet customer due diligence requirements.
• AML/CTF Legislation means the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act’) and the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth), as amended from time to time.
• AUSTRAC means Australian Transaction Reports and Analysis Centre.
• Australian Privacy Principles means the principles set out in schedule 1 of the Privacy Act.
• Cookies means small text files that are transferred to a user’s computer hard drive by a website for the purpose of storing information about the user’s identity, browser type, or Website-visiting patterns.
• Disclosure of information means providing information to persons outside of Finchley & Kent.
• Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not, and whether recorded in a material form or not.
• Privacy Act means the Privacy Act 1988 (Cth) as amended from time to time.
• Privacy Officer means the contact person within Finchley & Kent for questions or complaints regarding Finchley & Kent’s handling of Personal Information.
• Sensitive Information is Personal Information that includes information relating to a person’s racial or ethnic origin, political opinions, religion, trade union or other professional or trade association membership, sexual preferences, and criminal record, and also includes health information.
• Suspicious Matter Report means a report that we are required to submit to AUSTRAC if a suspicious matter reporting obligation arises, as defined in section 41 of the AML/CTF Act.
• Tipping off prohibition means the prohibition under the AML/CTF Act on disclosing to a person that we have lodged, are required to lodge, or have prepared, a Suspicious Matter Report to lodge with AUSTRAC, or other information prohibited to be disclosed under the AML/CTF Legislation, where such disclosure would or could reasonably be expected to prejudice a criminal investigation.
• Use of information means use of information within Finchley & Kent.
• Website means the website accessible via the internet or similar network that is owned, operated or made available by or on behalf of Finchley & Kent, including any associated domains, subdomains and content. The URL of the Finchley & Kent Website at the date of this Privacy Policy is www.finchleyandkent.com.au.
• You mean an individual in respect of whom we have collected and hold Personal Information or intend to do so.

2. Who do we collect Personal Information about?

The Personal Information we may collect and hold includes (but is not limited to) Personal Information about:

• clients, including potential clients and past clients
• service providers or suppliers
• prospective, current and past employees and contractors
• accountants, solicitors, barristers and other individuals who provide services to our clients
• beneficiaries of trusts and estates administered by our clients
• individuals with a connection to a client that uses our service (for example, an officeholder of a corporate client)
• other third parties with whom we come into contact

3. What kind of Personal Information do we collect and hold?

We may collect and hold Personal Information from you and other individuals that is reasonably necessary:

• to provide you with our services
• for us to carry out one or more of our functions or activities
• to enable us to comply with our legal obligations (which include our AML/CTF Obligations)

The Personal Information we may collect for these purposes include your:

• name
• gender
• date of birth
• address
• phone numbers
• email addresses
• occupation
• bank account and other payment details
• details of your identification documents or government identifiers, such as your driver’s licence, passport and tax file number
• financial information, including details of:
  • your income, assets, investments and properties
  • your insurance policies
  • estate planning strategies
  • taxation information
  • ABN/ACN
• health information
• employment history
• qualifications
• references
• payroll tax
• superannuation information
• any other information reasonably necessary for us to provide our services, administer our relationship with you, assess your needs, comply with legal or regulatory obligations, or manage our business operations

4. How do we collect Personal Information?

We generally collect Personal Information directly from you. For example, Personal Information is collected through our file opening and other administrative processes, such as completing forms, when you apply for a job with us, and other interactions that we may have with you or a third party that you are associated with, in the course of providing you with our products and services, including when you visit our Website, call us or send us correspondence.

We may also collect Personal Information about you through publicly available sources, from a third party – such as electronic verification services, referrers and marketing agencies – or from documentation or information provided by our client. If so, we will take reasonable steps to ensure that you are made aware of this Privacy Policy. We may also use third parties to analyse traffic at our website, which may involve the use of Cookies. Information collected through such analysis is anonymous.

We will not collect Sensitive Information about you without your consent, unless an exemption in the APPs applies. These exceptions include if the collection is required or authorised by law, or necessary to take appropriate action in relation to suspected unlawful activity or serious misconduct.

If the Personal Information we request is not provided by you, we may not be able to provide you with the benefit of our services or meet your needs appropriately.

Where lawful and practical, you may interact with us anonymously or using a pseudonym, for example when making a general enquiry or certain complaints. However, in many circumstances, including where we provide financial services or are required to comply with AML/CTF obligations, we may need to identify you and verify your identity before we can provide services.

Where we collect information through fact finding, risk profiling, onboarding or review processes, we will only collect information that is reasonably necessary for our services, our functions and activities, or our legal and regulatory obligations.

5. Why do we collect and hold Personal Information?

As above, we collect Personal Information so that we can provide our services and carry out the necessary functions to enable us to provide those services, including complying with the law.

We may use and disclose the information we collect about you for the following purposes:

• complying with our legal and regulatory obligations (including, but not limited to, our AML/CTF Obligations)
• providing you with our products and services
• reviewing and meeting your ongoing needs
• providing you with information we believe may be relevant or of interest to you
• informing you about other products or services we offer, sending you information about special offers, or inviting you to events
• considering any concerns or complaints you may have
• helping us improve the products and services offered to you and to enhance our overall business
• a financial planner may collect and hold Personal Information to assist in providing financial planning and personal risk services

We may use and disclose your Personal Information for any of these purposes. We may also use and disclose your Personal Information for secondary purposes which are related to the primary purposes set out above, or in other circumstances authorised by the Privacy Act.

Sensitive Information will be used and disclosed only for the purpose for which it was provided (or a directly related secondary purpose), unless you agree otherwise, or an exemption in the Privacy Act applies.

6. Who might we disclose Personal Information to?

We may disclose Personal Information to:

• a related entity of Finchley & Kent
• an agent, contractor or service provider we engage to carry out our functions and activities, such as our lawyers, accountants, debt collectors or other advisers
• an opposing law firm or solicitor
• organisations involved in a transfer or sale of all or part of our assets or business
• organisations involved in managing payments, including payment merchants and other financial institutions such as banks
• regulatory bodies, government agencies, law enforcement bodies and courts
• anyone else to whom you authorise us to disclose it
• approved technology providers, including approved artificial intelligence and automated technology providers, where reasonably necessary to provide services, support business operations, prepare records, conduct compliance reviews, or meet legal and regulatory obligations

If we disclose your Personal Information to service providers that perform business activities for us, they may only use your Personal Information for the specific purpose for which we supply it.

When disclosing Personal Information about an individual, we ensure that we will not breach the Tipping off prohibition.

7. Unsolicited Personal Information

We may receive unsolicited Personal Information about you. If this occurs, we will comply with our obligations under the Privacy Act. We may destroy or de-identify all unsolicited Personal Information we receive, unless it is relevant to our purposes for collecting Personal Information.

We may retain additional information we receive about you if it is combined with other information, we are required or entitled to collect. If we do this, we will retain the information in the same way we hold your other Personal Information. We may de-identify and/or destroy this information unless we are required to keep it by law.

8. Website collection and Cookies

We collect Personal Information when we receive completed online generated forms from our website www.finchleyandkent.com.au. We may also use third parties to analyse traffic at that Website, which may involve the use of Cookies. Information collected through such analysis is anonymous.

You can view and access our Privacy Policy by clicking on the privacy button on our website.

To use our website, you must consent to our use of Cookies. You can withdraw or modify your consent to our use of Cookies at any time. If you no longer wish to receive Cookies, you can use your web browser settings to accept, refuse and delete Cookies. To do this, follow the instructions provided by your browser. Please note that if you set your browser to refuse Cookies, you may not be able to use all of the features of our website.

Cookies do not contain Personal Information in themselves but can be used to identify a person when combined with other information. Cookies are small text files which are transferred to your computer’s hard drive through your web browser that enables our website to recognise your browser and capture and remember certain information.

We also use Cookies to understand how users interact with our website, to compile aggregate data about our website traffic, including where our website visitors are located, and interaction so that we can offer better user experiences.

We use analytics on the site. We do not pass any personally identifiable information through this function; however, the data we collect may be combined with other information which may be identifiable to you.

Click stream data

When you visit and browse our website, our website host may collect Personal Information for statistical, reporting, and maintenance purposes. Personal Information collected by our website host will not be used to identify you. The information may include:

• your visit to our website and the number of pages viewed
• the date, time, and duration of a visit
• the IP address of your computer
• the path taken through our website

Finchley & Kent’s Website host uses this information to administer and improve the performance of our website, including to assist with the diagnoses of, and to provide support for, any issues with our website or services.

9. The use of automated decision-making (including artificial intelligence)

Finchley & Kent may use approved artificial intelligence (AI) and automated technologies to assist with administrative functions, meeting and file note preparation, research, document drafting, compliance reviews, customer communications, reporting, financial modelling, cashflow analysis and other operational activities.

These technologies may involve the processing of personal information where reasonably necessary to provide services, meet legal and regulatory obligations, improve operational efficiency or support our business operations.

AI systems are used to support, and not replace, professional judgement. Financial advice, recommendations, compliance decisions and client outcomes remain subject to appropriate human review and oversight.

Where practical, personal information processed using AI technologies will be minimised, anonymised, de-identified or pseudonymised.

We only permit the use of AI technologies that have been assessed against our privacy, security, compliance and governance requirements.

Where automated processes are used, they are typically designed to support human decision-making and are not solely determinative of outcomes that significantly affect you. In limited circumstances, automated technologies may assist in producing outputs or recommendations that are subsequently reviewed by appropriately authorised personnel.

Automated decision-making may involve:

• profiling, where we analyse Personal Information to evaluate certain characteristics, such as investment preferences, risk profile, or likely interests
• modelling and cashflow analysis
• comparison of scenarios

Where Personal Information is processed using AI or automated technologies, it will only be used for authorised purposes and handled in accordance with this Privacy Policy and applicable privacy laws.

You may request further information about how automated decision-making is used in relation to your Personal Information, or request that we review a decision, by contacting us using the details set out in section 20 of this Privacy Policy.

10. Sending information overseas

We may disclose Personal Information to related entities, service providers, suppliers and technology providers, including cloud-based service providers located in Australia or overseas.

It is not practical to identify every country in which Personal Information may be disclosed, stored or processed. However, overseas recipients are likely to be located in countries including the United States, New Zealand, the Philippines, Vietnam, India, South Africa and Sri Lanka.

We will not send Personal Information to recipients outside of Australia unless:

• we have taken reasonable steps to ensure that the recipient does not breach the Act and the APPs
• the recipient is subject to an information privacy scheme similar to the Privacy Act
• the individual has consented to the disclosure

We may engage service providers, including technology and artificial intelligence providers, located outside Australia. As a result, personal information may be transferred to, stored or processed in overseas jurisdictions.

Personal information stored overseas may be subject to the laws of the country in which the information is held and may be accessible by foreign governments, courts, regulators or law enforcement agencies in accordance with those laws.

We take reasonable steps to ensure overseas recipients protect Personal Information in a manner consistent with Australian privacy requirements. However, Personal Information transferred overseas may be subject to the laws of the country in which it is stored or processed.

11. Management of Personal Information

We recognise the importance of securing the Personal Information of our clients. We will take steps to ensure your Personal Information is protected from misuse, interference or loss, and unauthorised access, modification or disclosure. Such steps include technical and organisational measures.

Your Personal Information is generally stored in our computer database, including our cloud storage databases. Any paper files are stored in secure areas.

12. Direct marketing

We may send you direct marketing communications and information about our services, opportunities, or events that we consider may be of interest to you. These communications may be sent in various forms, including mail, SMS, and email, in accordance with applicable marketing laws, such as the Spam Act 2003 (Cth).

We may only use Personal Information we collect from you for the purposes of direct marketing without your consent if:

• the Personal Information does not include Sensitive Information
• you would reasonably expect us to use or disclose the information for the purpose of direct marketing
• we provide a simple way of opting out of direct marketing
• you have not requested to opt out of receiving direct marketing from us

If we collect Personal Information about you from a third party, we will only use that information for the purposes of direct marketing if you have consented (or it is impracticable to obtain your consent), and we will provide a simple means by which you can easily request not to receive direct marketing communications.

We will draw your attention to the fact you may make such a request in our direct marketing communications.

You have the right to ask us not to use or disclose your Personal Information for the purposes of direct marketing, or for the purposes of facilitating direct marketing, by other organisations. We give effect to your request within a reasonable period of time.

You may also request that we provide you with the source of their information. If such a request is made, we notify you of the source of the information, free of charge, within a reasonable period of time.

We maintain records of marketing preferences and will take reasonable steps to ensure individuals who have opted out do not receive direct marketing communications.

13. Contractual arrangements with third parties

We will make third parties that we contract with aware of this Privacy Policy and will also ensure that those third parties have implemented policies in relation to the management of your Personal Information in accordance with the Privacy Act.

These policies include:

• regulating the collection, use and disclosure of Personal and Sensitive Information
• de-identifying Personal and Sensitive Information wherever possible
• ensuring that Personal and Sensitive Information is kept securely, with access to it only by authorised employees or agents of the third parties
• ensuring that the Personal and Sensitive Information is only disclosed to organisations which are approved by us

14. Identifiers

We do not adopt identifiers assigned by the Government (such as drivers’ licence numbers) for our own file recording purposes, unless one of the exemptions in the Privacy Act applies.

15. How do we keep Personal Information accurate and up to date?

We are committed to ensuring that the Personal Information we collect, use, hold and disclose is relevant, accurate, complete and up to date.

We encourage you to contact us to update any Personal Information we hold about you. See section 20 of this Privacy Policy for contact details.

If we correct information that has previously been disclosed to another entity, we will notify the other entity within a reasonable period of the correction. Where we are satisfied information is inaccurate, we will take reasonable steps to correct the information within 30 days, unless you agree otherwise. We do not charge you for correcting the information.

16. How long will we keep your Personal Information?

We will keep your Personal Information only for as long as required for our business purposes and as required by law, including as required to comply with our AML/CTF Obligations.

Where there is no longer a need to keep your Personal Information, we will take reasonable steps to destroy or de-identify your Personal Information.

17. Accessing your Personal Information

Subject to the exceptions set out in the Privacy Act, you may gain access to the Personal Information that we hold about you by contacting the Finchley & Kent’s Privacy Officer.

We will provide access within a reasonable time, usually 30 days of receiving the individual’s request. If we refuse to provide the information, we will provide reasons for the refusal.

We will require identity verification and specification of what information is required. An administrative fee for search and photocopying costs may be charged for providing access.

18. Updates to this Privacy Policy

This Privacy Policy will be reviewed from time to time to take account of new laws, regulations and technology, and changes to our operations and the business environment.

When we update this Privacy Policy, we will notify you by posting an update on our website.

19. Notifiable data breaches

We maintain a data breach response process. Where we suspect unauthorised access, disclosure or loss of Personal Information, we will take steps to contain and assess the incident.

If a breach is likely to result in serious harm and is an ‘eligible data breach’, we will comply with our obligations under the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner where required.

20. How to contact us, and making a complaint

We have an effective complaint handling process in place to manage privacy risks and issues.

The complaints handling process involves:

• identifying (and addressing) any systemic/ongoing compliance problems
• increasing consumer confidence in our privacy procedures
• helping to build and preserve our reputation and business

You can make a complaint to us about the treatment or handling of your Personal Information by lodging a complaint with the Privacy Officer contactable at info@finchleyandkent.com.au.

If you have any questions about this Privacy Policy, or wish to make a complaint about how we have handled your Personal Information, you can lodge a complaint with us by:

• Writing: GPO Box 3654, Sydney NSW 2001
• Emailing: info@finchleyandkent.com.au

If you are not satisfied with our response to your complaint, you can also refer your complaint to the Office of the Australian Information Commissioner by:

• Telephone: 1300 363 992
• Writing: Director of Complaints, Office of the Australian Information Commissioner, GPO Box 5288, SYDNEY NSW 2001
• Online submission: OAIC Web Form

21. Your rights

This Privacy Policy contains information about how:

• you may access the Personal Information we hold about you
• you may seek the correction of your Personal Information
• you may complain about a breach of the Privacy Act, including the APPs
• we will deal with a privacy complaint