CoSec Partners Pty Ltd (ABN 58 615 782 799), trading as CoSec Partners, is committed to protecting your privacy. This policy explains how we collect, use, store, and disclose personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
Information we collect
We collect personal information that is reasonably necessary to provide our services. This includes: your name, email address, phone number, and firm name when you place an order or contact us; the names, residential addresses, dates of birth, and places of birth of proposed officeholders and members, as required to register a company or prepare a trust deed; the Director Identification Number of each proposed director and acting alternate director, which we collect to verify that the director holds one before their appointment (director IDs apply to directors, not to members merely because they hold shares, and are not currently provided to ASIC as part of a company registration); the email addresses of people who need to sign a consent; identification and verification records collected to meet our obligations under the AML/CTF Act; documents you upload or email to us with an order; and payment information processed securely through our payment provider (we do not store credit card details on our systems).
If your firm sets up an AML/CTF reliance arrangement with us, we collect your firm's details, its AUSTRAC enrolment details, the name and contact details of its AML compliance officer, the name and role of the person who signs, and the internet (IP) address it was submitted from.
When someone signs a consent online through a link we email them, we keep the signed document, their typed or drawn signature, the date and time, and the IP address and browser it was signed from. We keep this as evidence of who signed and when, with the company's records.
We collect information about how our website is used. Our hosting provider's cookieless analytics gives us aggregated figures such as pages visited and referring sites, which do not identify you. We also use Google Analytics, which sets cookies to count visits and see how people find and use the site, such as pages viewed, how long they stay and the type of device and browser. Google gives us this as aggregated reports and we do not use it to identify you. We have turned off Google's advertising features. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout. We also keep our own record of how people move through the order forms and what they search for on the site, with the page and referring site and a random ID for the visit. If you are signed in to the client portal, that record is linked to your account.
When you sign in, create an account or reset your password, Cloudflare runs an automatic security check to confirm you are a person rather than an automated program, which uses information about your browser and device.
How we use your information
We use personal information to: process your orders and provide our services; lodge documents with ASIC, the ATO, and other government agencies on your behalf; communicate with you about your orders, account, and our services; comply with our legal and regulatory obligations; keep our website and your account secure; and improve our website and services.
We do not use your personal information for direct marketing unless you have agreed to it, and you can opt out at any time by contacting us.
Who we share your information with
We share personal information with: ASIC and the ATO as required to provide our services (company registration, annual statements, tax registrations); our independent legal partner, Key Legal, who reviews and signs off trust and SMSF deeds; our payment processor for the purpose of processing your payment; and our technology service providers who host and maintain our systems, deliver our emails, run the security check on our sign-in pages, and provide the artificial intelligence service we use, all of whom are bound by confidentiality obligations. We use artificial intelligence to check orders for errors, to read orders and documents emailed to us, to fill in the company, trust, SMSF and deed order forms from a client brief or documents you give it (such as an existing trust deed you upload), and to write a short welcome from your firm's public website when you create an account. Documents you upload to fill in an order form are deleted as soon as they have been read, and tax file numbers are never taken from them. A person at CoSec Partners reviews every order before it is lodged.
When you order for a company, we email each person who needs to sign a consent a link to sign it, unless you tell us you will collect their signature yourself.
We do not sell, rent, or trade your personal information to third parties. We may disclose information where required by law, court order, or regulatory authority.
How we store and protect your information
Personal information is stored on secure cloud servers in Japan (Tokyo). We implement reasonable technical and organisational measures to protect your information from unauthorised access, loss, misuse, or alteration. These measures include encrypted data transmission, access controls, and regular security reviews.
We retain personal information for as long as necessary to provide our services and comply with our legal obligations. Company records are retained in accordance with ASIC requirements. You may request deletion of your personal information at any time, subject to our legal retention obligations.
Overseas disclosure
Some of our service providers hold or process personal information outside Australia. Our database and website are hosted in Japan (Tokyo). Our payment processor (Stripe), our email delivery provider, and the artificial intelligence provider we use to check orders, read emailed orders and fill in order forms (Anthropic) may process information in the United States. Our hosting provider (Vercel), the provider of our sign-in security check (Cloudflare) and Google, for Google Analytics, may process limited usage and device data outside Australia. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
Ordering through Claude
Accounting and legal firms we have approved can connect Claude, an AI assistant made by Anthropic, to their client portal account and place orders in a chat. This section explains how information is handled when they do.
What we receive. When Claude gives a quote, looks up your account or orders, or places an order, it sends us only the details needed for that request. For an order these are the same details the matching online order form asks for, which can include the names, residential addresses, dates and places of birth and Director IDs of officeholders and members, and existing tax file numbers if you choose to give them. We also record your answers to the order's declarations, that you gave them in Claude and when, and how you chose to pay. Your name, email, phone and firm come from your portal account. We keep a short technical log of each request, with your account ID and whether it worked, which does not record the details of your order.
What we do not receive. We never receive a transcript of your conversation with Claude, and we cannot see your other chats, files or connectors. You sign in on our own sign-in page, so Claude never receives your portal password. Card payments are made on a secure Stripe payment page, so card details are never entered in the chat. Tax file numbers are never shown back in order summaries or emails.
Where it is held. What you type in Claude is collected and held by Anthropic in your Claude account, under your own Claude plan's terms, privacy policy and data settings, and may be processed in the United States. We do not control how Anthropic handles your chats. Once an order reaches us, it is stored with our other order records in Japan (Tokyo) and handled under this policy in the same way as an order placed on our website, including a review by a person at CoSec Partners before anything is lodged. If you would rather not give tax file numbers in a chat, leave them out of the order and give them to our team directly.
Access and disconnecting. Claude has the same access as your portal login, so it can see only the orders you can see in the client portal. You can disconnect Claude at any time from Connectors in Claude's settings, and we can switch off a firm's access at any time.
Tax file numbers
Where we assist with ABN, TFN, or other tax registrations, we may collect tax file numbers. We handle tax file number information in accordance with the Privacy (Tax File Number) Rule 2015 and the Privacy Act 1988 (Cth): we collect it only for the registration you have asked us to complete, use and disclose it only for that purpose or as required by law, and do not keep it longer than necessary. Tax file numbers are removed before our artificial intelligence service checks an order, are not saved with your order form progress on your device, and are deleted from our systems 30 days after the order is lodged, delivered or cancelled.
Data breaches
We maintain procedures to detect and respond to data breaches. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
Your rights
You have the right to: access the personal information we hold about you; request correction of inaccurate or incomplete information; request deletion of your information (subject to legal retention requirements); withdraw consent for marketing communications; and lodge a complaint about our handling of your information.
To exercise any of these rights, contact us at team@cosecpartners.com.au or call 1300 226 226.
Cookies
We keep cookies to a minimum. We use essential cookies required for the website to function (such as keeping you signed in to your client portal). We also use storage in your browser, on your own device, to remember your settings, to hold the random visit ID described above until you close the tab, and to save your progress on an order form so you can come back to it. That saved progress includes the details you have typed, and it stays on the device until you submit or clear the form, so clear it if you use a shared computer. Google Analytics, as described above, sets its own cookies to tell visits apart. We do not use advertising or cross-site tracking cookies. You can manage or clear cookies and site storage through your browser settings, though disabling them may affect how our website works.
Third-party links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to review the privacy policies of any third-party site you visit.
Changes to this policy
We may update this policy from time to time. The current version will always be available on this page with the date of last update shown above.
Complaints
If you believe we have breached the Australian Privacy Principles, please contact us at team@cosecpartners.com.au. We will investigate your complaint and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
Contact
Privacy Officer, CoSec Partners Pty Ltd, 232 Unley Road, Unley SA 5061. Phone: 1300 226 226. Email: team@cosecpartners.com.au.