Privacy Policy

1. Who this policy applies to

This policy applies to personal information we collect and hold about clients, prospective clients, website users, referrers, third party payers, witnesses, family members, employers, education providers, suppliers, contractors, staff applicants and other people who interact with us.

In this policy, “we”, “us” and “our” means Leyton Stone Law Pty Ltd. “You” means the individual whose personal information we collect or hold.

2. Our privacy and professional obligations

We handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, where they apply to us.

As an incorporated legal practice, we also handle client information consistently with our professional obligations under the Legal Profession Uniform Law (NSW), the applicable Uniform Rules, professional conduct obligations, confidentiality obligations and duties owed by legal practitioners.

3. The kinds of personal information we collect

The kinds of personal information we collect depend on the nature of your enquiry or matter. They may include:

• your name, date of birth, contact details and preferred method of communication;
• identity information, including passports, birth certificates, marriage certificates, police checks, photographs and other identity documents;
• migration information, including visa history, immigration status, travel history, refusal or cancellation history and Department of Home Affairs correspondence;
• family, relationship, household and dependency information;
• employment, business, education, financial and taxation information where relevant to your matter;
• health information, character information, criminal history, biometric-related material or other sensitive information where relevant to a legal matter;
• communications with us, including emails, calls, meeting notes, file notes, forms, portal messages and consultation records;
• billing, payment, trust accounting and costs information;
• information about third parties involved in your matter, such as family members, employers, sponsors, agents, schools, migration agents, witnesses, referees and representatives; and
• technical information from your use of our website, such as IP address, browser type, device information, pages visited and referral source.

4. Sensitive information

We may collect sensitive information where it is reasonably necessary for our functions or activities, where you consent, or where collection is otherwise permitted by law. Sensitive information may include health information, racial or ethnic origin, religious beliefs, criminal record, membership of professional associations, biometric information or other information relevant to character, identity, family or migration issues.

Where possible, we only collect sensitive information that is necessary for the specific legal service, application, advice, dispute or regulatory obligation involved.

5. How we collect personal information

We usually collect personal information directly from you. We may collect information when you:

• contact us by phone, email, website form, booking platform or social media;
• book or attend a consultation;
• complete an intake form, questionnaire, authority, costs agreement or engagement document;
• send documents or information to us;
• instruct us to act for you;
• use our website or interact with online content; or
• communicate with us during the course of a legal matter.

We may also collect personal information from third parties where it is lawful and appropriate, including family members, employers, sponsors, education providers, migration agents, referrers, interpreters, accountants, medical practitioners, government agencies, courts, tribunals, regulators, publicly available sources and other people involved in your matter.

6. If you do not provide information

You do not have to provide personal information to us. However, if you do not provide information we request, we may be unable to respond to your enquiry, assess whether we can act, provide legal advice, prepare documents, lodge applications, meet professional obligations, verify identity, manage conflicts or continue acting for you.

7. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for purposes including:

• responding to enquiries and consultation bookings;
• checking conflicts and deciding whether we can act;
• verifying identity and authority to act;
• providing legal advice and legal services;
• preparing, reviewing and lodging visa applications, sponsorship applications, nomination applications, review applications, submissions and related documents;
• communicating with clients, prospective clients, representatives, third parties, courts, tribunals, regulators and government agencies;
• managing files, deadlines, evidence, billing, trust accounting, costs disclosure and client care;
• complying with legal, regulatory, insurance, professional conduct and risk management obligations;
• dealing with complaints, disputes, audits, professional indemnity issues or regulatory enquiries;
• improving our website, services, systems, templates and processes;
• sending legal updates, client alerts or service information where permitted; and
• any other purpose required or authorised by law, or to which you consent.

8. Disclosure to third parties

Subject to our confidentiality and professional obligations, we may disclose personal information to third parties where reasonably necessary for your matter or our business operations, including:

• the Department of Home Affairs, Administrative Review Tribunal, courts, government agencies, regulators and law enforcement bodies where lawful or required;
• employers, sponsors, education providers, skills assessing authorities, health providers, police authorities, accountants, migration agents, interpreters, translators and other professional advisers;
• other parties involved in your matter, where you have authorised disclosure or disclosure is necessary to provide legal services;
• technology, hosting, cloud storage, email, document management, practice management, booking, payment, analytics and security service providers;
• banks, payment processors, insurers, auditors and professional indemnity providers;
• debt recovery providers or external advisers where necessary to recover unpaid fees; and
• any person or body to whom disclosure is required or authorised by law.

9. Overseas disclosure

Your matter may involve overseas recipients. For example, we may need to communicate with overseas clients, family members, employers, education providers, government agencies, document issuing bodies, referees, experts or service providers.

We also use reputable technology and cloud-based service providers. Some service providers may store, process or back up information outside Australia, or allow support access from overseas locations. The countries involved may vary depending on the provider, system and matter.

Where we disclose personal information overseas, we take reasonable steps to do so consistently with applicable privacy obligations and our professional duties.

10. Website, cookies and online bookings

Our website may collect technical information through standard web technologies such as cookies, analytics tools, server logs, embedded content or booking tools. This information helps us maintain website security, diagnose issues, understand website use and improve our services.

If you use a third party booking, payment, form or communication tool, that provider may also collect and process personal information under its own privacy terms.

11. Marketing communications

We may send legal updates, invitations or information about our services where permitted by law. You can opt out at any time by using an unsubscribe function where available or by contacting us at info@leytonstonelaw.com.

12. Storage and security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These steps may include access controls, secure systems, file permissions, password protection, multi-factor authentication, staff training, confidentiality processes, secure document management and appropriate retention controls.

No method of transmission or storage is completely secure. If we become aware of an eligible data breach, we will take steps required by the Notifiable Data Breaches scheme and any other applicable legal or professional obligations.

13. Retention and destruction

We retain personal information for as long as necessary for the purpose for which it was collected, for legal practice management, for professional indemnity and risk management purposes, and to comply with legal, regulatory, accounting and professional obligations.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it, unless we are required or permitted to retain it.

14. Access and correction

You may request access to personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

We may request proof of identity before responding. We may refuse access or correction where permitted by law, including where access would prejudice legal professional privilege, confidentiality, another person’s privacy, legal proceedings, investigations or our professional obligations. If we refuse a request, we will explain why where it is reasonable and lawful to do so.

15. Complaints

If you have a privacy concern or complaint, please contact us first so we can try to resolve it promptly.

We will usually acknowledge your complaint within a reasonable time and may ask for further information so we can investigate and respond properly.

If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

16. Automated decision-making

We do not use computer programs to make decisions that are solely automated and that determine whether we will provide legal services or determine the outcome of a client’s legal matter.

We may use technology to assist with administration, document management, research, triage, workflows, reminders or drafting support. Any legal advice, strategy, decision to act, or substantive work on a legal matter remains subject to professional judgment and supervision.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will be published on our website and will apply from the date it is posted, unless stated otherwise.

18. Contact details