Privacy Policy

1. Who this policy applies to

This policy applies to personal information we collect and hold about clients, prospective clients, website users, referrers, third party payers, witnesses, family members, employers, education providers, suppliers, contractors, staff applicants and other people who interact with us.

In this policy, “we”, “us” and “our” means Leyton Stone Law Pty Ltd. “You” means the individual whose personal information we collect or hold.

2. Our privacy and professional obligations

We handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, where they apply to us.

As an incorporated legal practice, we also handle client information consistently with our professional obligations under the Legal Profession Uniform Law (NSW), the applicable Uniform Rules, professional conduct obligations, confidentiality obligations and duties owed by legal practitioners.

3. The kinds of personal information we collect

The kinds of personal information we collect depend on the nature of your enquiry or matter. They may include:

• your name, date of birth, contact details and preferred method of communication;
• identity information, including passports, birth certificates, marriage certificates, police checks, photographs and other identity documents;
• migration information, including visa history, immigration status, travel history, refusal or cancellation history and Department of Home Affairs correspondence;
• family, relationship, household and dependency information;
• employment, business, education, financial and taxation information where relevant to your matter;
• health information, character information, criminal history, biometric-related material or other sensitive information where relevant to a legal matter;
• communications with us, including emails, calls, meeting notes, file notes, forms, portal messages and consultation records;
• billing, payment, trust accounting and costs information;
• information about third parties involved in your matter, such as family members, employers, sponsors, agents, schools, migration agents, witnesses, referees and representatives; and
• technical information from your use of our website, such as IP address, browser type, device information, pages visited and referral source.

4. Sensitive information

We may collect sensitive information where it is reasonably necessary for our functions or activities, where you consent, or where collection is otherwise permitted by law. Sensitive information may include health information, racial or ethnic origin, religious beliefs, criminal record, membership of professional associations, biometric information or other information relevant to character, identity, family or migration issues.

Where possible, we only collect sensitive information that is necessary for the specific legal service, application, advice, dispute or regulatory obligation involved.

5. How we collect personal information

We usually collect personal information directly from you. We may collect information when you:

• contact us by phone, email, website form, booking platform or social media;
• book or attend a consultation;
• complete an intake form, questionnaire, authority, costs agreement or engagement document;
• send documents or information to us;
• instruct us to act for you;
• use our website or interact with online content; or
• communicate with us during the course of a legal matter.

We may also collect personal information from third parties where it is lawful and appropriate, including family members, employers, sponsors, education providers, migration agents, referrers, interpreters, accountants, medical practitioners, government agencies, courts, tribunals, regulators, publicly available sources and other people involved in your matter.

6. If you do not provide information

You do not have to provide personal information to us. However, if you do not provide information we request, we may be unable to respond to your enquiry, assess whether we can act, provide legal advice, prepare documents, lodge applications, meet professional obligations, verify identity, manage conflicts or continue acting for you.

Where it is lawful and practicable, you may deal with us anonymously or using a pseudonym, for example when making a general enquiry. We generally cannot give legal advice or act for you without knowing who you are.

7. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for purposes including:

• responding to enquiries and consultation bookings;
• checking conflicts and deciding whether we can act;
• verifying identity and authority to act;
• providing legal advice and legal services;
• preparing, reviewing and lodging visa applications, sponsorship applications, nomination applications, review applications, submissions and related documents;
• communicating with clients, prospective clients, representatives, third parties, courts, tribunals, regulators and government agencies;
• managing files, deadlines, evidence, billing, trust accounting, costs disclosure and client care;
• complying with legal, regulatory, insurance, professional conduct and risk management obligations;
• dealing with complaints, disputes, audits, professional indemnity issues or regulatory enquiries;
• improving our website, services, systems, templates and processes;
• sending legal updates, client alerts or service information where permitted; and
• any other purpose required or authorised by law, or to which you consent.

8. Disclosure to third parties

Subject to our confidentiality and professional obligations, we may disclose personal information to third parties where reasonably necessary for your matter or our business operations, including:

• the Department of Home Affairs, Administrative Review Tribunal, courts, government agencies, regulators and law enforcement bodies where lawful or required;
• employers, sponsors, education providers, skills assessing authorities, health providers, police authorities, accountants, migration agents, interpreters, translators and other professional advisers;
• other parties involved in your matter, where you have authorised disclosure or disclosure is necessary to provide legal services;
• technology, hosting, cloud storage, email, document management, practice management, booking, payment, analytics and security service providers;
• banks, payment processors, insurers, auditors and professional indemnity providers;
• debt recovery providers or external advisers where necessary to recover unpaid fees; and
• any person or body to whom disclosure is required or authorised by law.

9. Overseas disclosure

Your matter may involve overseas recipients. For example, we may need to communicate with overseas clients, family members, employers, education providers, government agencies, document issuing bodies, referees, experts or service providers.

We use reputable technology and cloud-based service providers for email, document storage, practice management, booking and payments. Our main systems store client information in Australia. Some providers may process information temporarily outside Australia, or allow their technical support staff to access it from overseas, in limited circumstances. Based on the providers we currently use, those countries are likely to include the United States and Canada. Other countries may be involved where your matter itself has an overseas connection.

When we use service providers that may hold or access personal information overseas, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, including by using providers bound by contractual privacy, confidentiality and security obligations. Where your matter requires us to communicate with people or bodies overseas, we do so on your instructions or as reasonably necessary to conduct your matter.

10. Website, cookies and online bookings

Our website may collect technical information through standard web technologies such as cookies, analytics tools, server logs, embedded content or booking tools. This information helps us maintain website security, diagnose issues, understand website use and improve our services.

If you use a third party booking, payment, form or communication tool, that provider may also collect and process personal information under its own privacy terms.

11. Marketing communications

We may send legal updates, invitations or information about our services where permitted by law. You can opt out at any time by using an unsubscribe function where available or by contacting us at info@leytonstonelaw.com.

12. Storage and security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These steps include technical and organisational measures such as access controls, secure systems, file permissions, password protection, multi-factor authentication, staff training, confidentiality processes, secure document management and appropriate retention controls.

No method of transmission or storage is completely secure. If we become aware of an eligible data breach, we will take steps required by the Notifiable Data Breaches scheme and any other applicable legal or professional obligations.

13. Retention and destruction

We retain personal information for as long as necessary for the purpose for which it was collected, for legal practice management, for professional indemnity and risk management purposes, and to comply with legal, regulatory, accounting and professional obligations.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it, unless we are required or permitted to retain it.

14. Access and correction

You may request access to personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

We may request proof of identity before responding. We may refuse access or correction where permitted by law, including where access would prejudice legal professional privilege, confidentiality, another person’s privacy, legal proceedings, investigations or our professional obligations. If we refuse a request, we will explain why where it is reasonable and lawful to do so.

15. Complaints

If you have a privacy concern or complaint, please contact us first so we can try to resolve it promptly.

We will usually acknowledge your complaint within a reasonable time and may ask for further information so we can investigate and respond properly.

If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

16. Automated decision-making

We do not arrange for computer programs to make decisions, or to do things substantially and directly related to making decisions, that could reasonably be expected to significantly affect your rights or interests. In particular, computer programs do not decide whether we will act for you, the advice we give you, or how your matter is conducted.

We use software to assist with administration, document management, scheduling and research. Any AI-assisted drafting is reviewed by a lawyer, and decisions about your matter are always made by a lawyer exercising professional judgment.

If this changes, we will update this policy to describe the kinds of personal information used and the kinds of decisions involved, as required by the Australian Privacy Principles.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will be published on our website and will apply from the date it is posted, unless stated otherwise.

18. Contact details