Privacy Policy

Introduction

Cohen Legal (ABN 35 611 751 181) is a Townsville-based law firm. In this Privacy Policy we refer to Cohen Legal as (“we, us or our”). We respect your privacy and are committed to protecting your personal information, which we handle in accordance with the Australian Privacy Principles (“APP”) in the Privacy Act 1988 (Cth) (“Privacy Act”).

This Privacy Policy explains how we manage personal information. It also describes your rights to access and correct personal information we hold about you, and how you can make a complaint about our management of your personal information. This is in addition to our obligations of confidentiality to clients and other parties arising from sources other than the Privacy Act.

Application of this Policy

This Privacy Policy applies to the personal information we collect, hold, use and disclose in the course of operating our legal practice. This includes personal information we manage to meet our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (the AML/CTF Act), as well as the personal information we handle for our general business purposes, including providing and marketing our services.

Some of the personal information we handle may still be subject to exemptions under the Privacy Act (for example, certain employee records) or to our separate duties of confidentiality to clients. Even where an exemption applies, we aim to handle your personal information consistently with this Policy.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The current version will be available on our website at www.cohenlegal.com.au.

 

What kinds of personal information do we collect?

Types of personal information

We collect your contact and identity details, financial information and case-related information about you and any relevant entity or person. We also collect information that assists us in conducting our business and in providing and marketing our services, such as your personal preferences, feedback and testimonials. This may include sensitive information.

The types of personal information we may collect includes:

• Identity information: name, date of birth, gender, signature, photographic identification, offices or directorships held;
• Contact information: residential and postal addresses, email addresses, telephone numbers;
• Professional and business information: occupation, employer, job title, professional qualifications, business holdings and structures;
• Financial information: bank account details, billing information, payment card details, tax file numbers;
• Matter-related information: information relevant to your legal matter or the legal matter of our client;
• Transaction information: details of services provided to you or your organisation;
• Communication records: records of correspondence and communications with you;
• Website and technical data: IP address, browser type, device information, pages visited, cookies;
• Recruitment information: employment history, qualifications, references, right to work status, background check results; and
• Sensitive information: including: sexual orientation, racial and ethnic origin, political beliefs, religious affiliation, criminal record, and health information.

Identity Verification and the AML/CTF Act

We may be required to verify your identity and collect certain information under the AML/CTF Act when we provide designated services. Identity documents might also be required for other services such as court matters, real property transactions and asset dealings.

This includes collecting identification documents and information about the source of funds, source of wealth and beneficial ownership of entities.

 

How do we collect and hold personal information?

Sources of information

We will generally collect personal information: from you directly when you provide your details to us; from you indirectly through emails, forms, face-to-face meetings, interviews, registration and attendance at seminars, business cards and telephone conversations and through use of the services and facilities available through our website and any social media channels; and from third parties in some instances, for example, we may use third parties to analyse traffic at our website, our blogs and social media channels, which may involve the use of cookies. In some circumstances we may collect personal information about an individual from a third party, for example, a report provided by a medical professional or an employment reference from another person. Anonymity and Pseudonymity

If you are a client, you have the option of requesting to deal with us anonymously or by using a pseudonym. However, in most cases this is not lawful nor practical for legal services. If you do not provide us with the personal information we request, we may not be able to provide you with legal services or respond to your enquiry, complete onboarding or due diligence requirements, or we may be delayed or restricted in acting for you.

Where required by APP 5, we will take reasonable steps to notify you of the matters required by law before, at, or as soon as practicable after we collect your personal information, unless providing that notice would be inconsistent with statutory tipping-off prohibitions or other legal restrictions.

If you provide us with personal information about another person, you should only do so where you are permitted to, and you should direct that person to this Privacy Policy where appropriate.

Why do we collect, hold, use and disclose your personal information?

We collect, hold, use and disclose personal information for the primary purpose of providing legal services to our clients, complying with regulatory and insurance obligations and operating our legal practice.

This includes providing legal advice and representation to you or our clients; managing client matters and files; conducting legal research and investigations; preparing and reviewing legal documents; communicating with you and others; billing and collecting fees (including under a Costs Agreement or retainer); complying with our legal, professional and insurance obligations; and administering and managing our firm.

Secondary purposes include financial management, system improvement, marketing and promoting our services, enforcement of our right to payment and managing the relationship between our firm and former clients once the retainer has concluded.

We may also use and disclose personal information for related secondary purposes, including maintaining and developing our relationship with you (including marketing and promoting our services unless you ask us to stop); quality assurance and service improvement, including training our or our providers' AI models subject to our confidentiality obligations; training and professional development; ongoing Customer Due Diligence under the AML/CTF Act; enforcement of our right to payment; internal reporting and analysis; and risk management and insurance.

Who do we disclose your personal information to?

We may disclose personal information to third parties to facilitate the purposes of collection in this policy. These purposes include disclosure to parties to proceedings or transactions and their representatives, to Courts, government and regulatory agencies as may be necessary or appropriate to establish legal rights and to progress transactions in which we are instructed. We also disclose information to third parties (such as data storage or archiving companies, our regulators or our insurers) who hold or process information for us.

Your personal information and confidential data is held by us subject to our duty of confidentiality under the Australian Solicitor's Conduct Rules ("ASCR") and any applicable undertakings or court rules. Subject to those obligations and for the purposes described in this Policy, we may disclose your personal information to: barristers, experts, investigators, consultants and other legal practitioners engaged on the matter; other parties to legal proceedings or transactions; courts, tribunals, government agencies and regulators (including AUSTRAC); our professional indemnity insurers, auditors and any Costs Assessor; service providers who assist us to operate our business (such as IT, AI, document-management, identity-verification, settlement, banking, payment and marketing providers); related entities; and any person you authorise, or as otherwise permitted or required by law or the ASCR.

Do we disclose your personal information overseas?

We will disclose information to overseas recipients where this is reasonably necessary to progress our instructions (dealing with a company with an overseas office, for example). Where we disclose personal information overseas, we will take reasonable steps required under APP 8 to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to that information.

We may disclose personal information to recipients located outside Australia where reasonably necessary or convenient to facilitate the purposes of collection, holding, use and disclosure of information stated in this policy.

This may apply, for example, where your matter involves overseas parties or proceedings; where overseas law firms, regulators, auditors, or our staff or contractors are involved; where our service providers (such as cloud, AI and IT providers) store or process information on overseas servers; or where you instruct, or authorise, us to do so.

 

How do we store and protect your personal information?

Security Measures

We hold your personal information using a system designed to protect against data breaches; however, like all data security systems, risks may only be mitigated, not eliminated. It is our practice to require our storage service providers to be reputable, and we seek assurances from them regarding their security and confidentiality practices.

Retention and Destruction

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and professional obligations and to ensure that pertinent evidence remains available if reasonably required. As a general guide, we retain records for a minimum of 7 years: 7 years from completion for conveyancing, property and business matters; a minimum of 7 years for AML/CTF records; and 7 years (or longer where limitation periods or matter risk require) for wills and estates, litigation, building and construction, insolvency and employment matters. When personal information is no longer required, we securely destroy or de-identify it. For the avoidance of doubt, original documents do not get destroyed and are stored securely in our Safe Custody.

What about links to third party websites?

Our website may contain links to third party websites, such as payment processors. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.

How can you access and correct your personal information?

Access to and correction of your Personal Information

You have the right to request access to or correction of the personal information we hold about you. To make an access request, please contact our Privacy Officer.

The Privacy Act permits us to refuse access or correction in some circumstances. If we do, we will give you written reasons (unless it is unreasonable or we are prohibited from doing so by law) and explain how you may complain.

Access and correction

We will respond to your request within a reasonable period, generally within 30 days. We may charge a reasonable fee to cover the costs of locating, retrieving and providing the information. If you are a client or former client we do not charge for recovery or storage of records that are your property but may charge for costs incurred in retrieval of other records or where urgent timelines or requests for documents to be delivered remotely, incur additional outlays.

If you are not a client or former client, our confidentiality obligations to them and other relevant exemptions under the Privacy Act may preclude us giving you the information requested. Request for search or recovery costs in advance does not mean that information will necessarily be released. We will inform you of any applicable fees before processing your request.

Correction of Your Personal Information

We take reasonable steps to ensure that the personal information we hold during the currency of your matter is accurate, up-to-date, complete and relevant. Records held subsequent to the completion of our work for you will not be monitored or updated unless further instructions are issued. If you believe that personal information, we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, you may request that we correct it.

We will respond to correction requests within a reasonable period. If we correct information that we have previously disclosed to a third party, we will notify that third party of the correction if you request us to do so.

How can you make a privacy-related complaint?

If you have any questions about privacy-related issues or wish to complain about our handling of your personal information, please contact us immediately. We may ask you to lodge your complaint in writing. Any complaint will be investigated without delay, and you will be notified of the making of a decision in relation to your complaint as soon as is practicable after it has been made, usually within 14 days.

You may also contact the relevant legal services regulator in your State or Territory.

Privacy officer details and complaints:

Att: Privacy Officer
Cohen Legal
Address: PO Box 959, Townsville Qld 4810
Email: info@cohenlegal.com.au
Phone: 07 4721 0264

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner, whose details follow.