Attwood Marshall Lawyers (“we”, “our”, “us”) is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, store, disclose and manage your personal information when you engage our legal services, visit our website, or interact with us.

This Privacy Policy also explains how you may access and correct your personal information and how you may make a privacy complaint.

1. What Personal Information We Collect

The personal information we collect depends on the nature of your matter and your interactions with us. It may include:

• full name
• date of birth
• residential and postal address
• contact details
• identification details (see Section 4)
• financial information (e.g. bank details for estate administration)
• employment information
• information relevant to your legal matter
• information you provide through our website, forms or correspondence

In some matters, we may collect sensitive information, including health information, where reasonably necessary to provide our legal services and where permitted by law.

We only collect personal information that is reasonably necessary for our functions and activities as a legal practice.

2. How We Collect Personal Information

We collect personal information in various ways, including:

• directly from you (in person, by phone, email or online)
• through our website or online forms
• through InfoTrack’s WebVOI system (for designated services)
• through an in-person Verification of Identity (VOI) process
• from third parties where authorised or required (e.g. financial institutions, government agencies, medical providers, other legal representatives)

We do not collect personal information that we do not need.

3. Why We Collect Personal Information

We collect personal information to:

• verify your identity
• provide legal services
• prepare legal documents
• comply with legal and regulatory obligations
• communicate with you
• manage our business operations
• prevent fraud and unauthorised access
• meet AML/CTF obligations (for designated services only)

If we cannot collect the information we require, we may be unable to act for you or provide legal services.

4. Identification (ID) Collection, Scanning and Retention

We collect and retain identification documents where reasonably necessary for the legal services we provide and for the reasons outlined in Section 3, including where identification is required by law, regulatory obligations, professional requirements, risk management practices, financial institutions, government agencies or other third parties involved in your matter.

4.1 Designated Services (WebVOI or In-Person VOI)

For matters regulated under the Anti-Money Laundering and Counter-Terrorism Financing Act or where a Verification of Identity (VOI) is otherwise required:

WebVOI (Primary Method)

We use InfoTrack WebVOI, a secure online Verification of Identity system.

• Clients upload identification documents directly into the WebVOI portal.
• InfoTrack securely stores and automatically destroys VOI data after seven (7) years.

• Further information regarding InfoTrack’s privacy and security practices is available on the InfoTrack website.

In-Person VOI (Alternative Method)

If a client cannot access the internet to complete a WebVOI, we may conduct an in-person paper-based VOI process.

• Identification documents may be scanned and retained for verification purposes.
• VOI documents are securely stored and destroyed after seven (7) years.

 
4.2 Retention

Identification documents and identity verification records are generally retained for seven (7) years after the matter is finalised, unless a longer retention period is required or permitted by law.

5. How We Use Personal Information

We use your personal information to:

• provide legal advice and services
• verify identity and authority
• prepare legal documents
• communicate with you and relevant third parties
• comply with legal and regulatory obligations
• manage our internal operations
• respond to enquiries and complaints

We take reasonable steps to ensure that personal information we collect, use and disclose is accurate, up-to-date, complete and relevant.

We do not use your personal information for direct marketing without your consent.

6. Disclosure of Personal Information

We may disclose your personal information to:

• courts, tribunals and regulatory authorities
• financial institutions, insurers and superannuation funds
• barristers, experts and other professionals assisting with your matter
• service providers such as InfoTrack (for VOI services)
• government agencies where required by law
• parties authorised by you

We may also disclose personal information to cloud-based technology providers and other service providers who support our business operations.

We do not sell, rent or trade personal information.

7. Overseas Disclosure

Some of our service providers may store or process information in locations outside Australia.

Where personal information is disclosed overseas, we take reasonable steps to ensure that such information is handled in a manner consistent with the requirements of the Privacy Act 1988 (Cth).

8. Storage and Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Our security measures include:

• encrypted digital storage
• access controls and permissions
• secure backups
• secure destruction protocols
• secure third-party systems (e.g. InfoTrack WebVOI)

If we become aware of an eligible data breach involving personal information, we will respond in accordance with our obligations under the Privacy Act 1988 (Cth), including notification to affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

9. Access and Correction

You may request access to, or correction of, your personal information at any time.

We will respond within a reasonable period and may require verification of identity before releasing or amending personal information.

10. Website, Cookies and Analytics

Our website may use cookies and analytics technologies to improve functionality, enhance user experience and monitor website performance.

Depending on the circumstances, information collected through cookies or analytics tools may constitute personal information.

You may disable cookies through your browser settings, however some website functionality may be affected.

11. Complaints

If you have concerns about how we handle your personal information, please contact:

Practice Manager
Attwood Marshall Lawyers
Email: hgilholme@attwoodmarshall.com.au

We will acknowledge your complaint and seek to resolve it within a reasonable period.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Office of the Australian Information Commissioner
Website: www.oaic.gov.au

Policy Last Updated July 2026