Privacy Policy

Cloudberry Law · ABN 25 687 587 840

Date reviewed: 3 November 2026

1. Our commitment

Cloudberry Law (ABN 25 687 587 840) (“we”, “us”, “our”) is committed to protecting your privacy. We collect, use, share, process, and manage Personal Information only as reasonably necessary for carrying out our functions and activities. Everything you tell us about your matter is kept confidential under our professional obligations as lawyers, whether or not the Privacy Act applies to it.

If we prepare to provide, provide you with, or reasonably anticipate that we may provide you with, any Designated Services, we will handle your Personal Information provided in relation to those services (AML/CTF Information) in an open and transparent way, subject to our legal obligations, in accordance with this Privacy Policy.

2. What this Privacy Policy covers and what privacy law applies to us

This Privacy Policy explains how we handle two kinds of Personal Information:

Enquiry and website information: information collected through this website, our call booking process and other enquiries before you engage us; and
AML/CTF Information: Personal Information we handle in connection with our AML/CTF obligations under the AML/CTF Framework when we prepare to provide, or provide, Designated Services.

Our practice's annual turnover is $3 million or less and none of the exceptions in s 6D of the Privacy Act applies to us, so we are a “small business operator” under s 6D. The Privacy Act applies to us only in relation to our activities carried on for the purposes of, or in connection with, the AML/CTF Act, regulations under it and the AML/CTF Rules, by operation of s 6E(1A) of that Act.

Accordingly, the Privacy Act, including the APPs, applies only to our collection, use, sharing, processing, and management of Personal Information required to comply with our obligations under the AML/CTF Framework (AML/CTF Information). Where the same Personal Information is collected or used both for AML/CTF purposes and for other purposes, we treat it as AML/CTF Information.

Other Personal Information we handle, including enquiry and website information, may not be covered by the Privacy Act, but this Privacy Policy explains how we handle it. We handle all Personal Information confidentially under the legal profession legislation (as defined in section 3A of the Legal Profession Uniform Law Application Act 2014 (NSW)), including the Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 (NSW).

If you book a call or contact us, we handle your enquiry and website information as described in this Privacy Policy. If you then engage us for a Designated Service, we will also collect AML/CTF Information, and the sections of this Privacy Policy marked “AML/CTF Information” will also apply.

Because the AML/CTF Act requires us to identify and verify our clients, you cannot deal with us anonymously or using a pseudonym when we provide, or prepare to provide, Designated Services (APP 2.2). You can make a general enquiry without identifying yourself, although we need your name and the names of the other parties involved to check for conflicts before we can discuss your matter.

3. Meaning of words used in this Privacy Policy

In this Privacy Policy the terms listed have the following meanings:

Term	Meaning
AML/CTF Act	Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).
AML/CTF Framework	AML/CTF Act, AML/CTF Rules and AUSTRAC-issued guidance.
AML/CTF Information	Personal Information that we handle for the purposes of, or in connection with, our activities relating to the AML/CTF Act, regulations under it or the AML/CTF Rules.
AML/CTF Rules	Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth) made under the AML/CTF Act.
APP/s	The Australian Privacy Principles in Schedule 1 of the Privacy Act.
AUSTRAC	Australian Transaction Reports and Analysis Centre.
Designated Services	The following professional services in table 6 of subsection 6(5B) of the AML/CTF Act, which are the only designated services we provide: assisting a person to plan, execute, or act on their behalf in a transaction to buy, sell or otherwise transfer a body corporate or legal arrangement (unless the transaction results from an order of a court or tribunal); assisting a person to plan, organise, execute, or act on their behalf in a transaction for equity or debt financing related to a body corporate or legal arrangement; selling or transferring a shelf company; assisting a person to plan, execute, or act on their behalf in the creation or restructuring of a body corporate or legal arrangement; arranging for another person to act as a company director or secretary, a power of attorney, a partner, a trustee, or an equivalent position on behalf of a nominator; and arranging for another person to act as a nominee shareholder for a body corporate or legal arrangement on behalf of a nominator.
We, us, our	Cloudberry Law (ABN 25 687 587 840).
KYC Information	Information sufficient to establish initial customer due diligence matters on reasonable grounds as required by the AML/CTF Act, or to fulfil our ongoing customer due diligence obligations under the AML/CTF Act, including: the identity of our customer; the identity of any person on whose behalf our customer is receiving the service; the identity of any person acting on behalf of the customer including their authority to act; if the customer is not an individual, the identity of any beneficial owners; whether the customer, beneficial owner, or any person acting on their behalf is a politically exposed person or a person designated for targeted financial sanctions; information regarding source of wealth and source of funds; the nature and purpose of the business relationship or transaction; and any other matter specified in the AML/CTF Rules.
OAIC	Office of the Australian Information Commissioner.
Personal Information	Information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not (Privacy Act s 6(1)).
Privacy Act	Privacy Act 1988 (Cth).
Sensitive Information	Personal Information that includes information or an opinion about an individual's: racial or ethnic origin; political opinions; membership of a political association; religious beliefs or affiliations; philosophical beliefs; membership of a professional or trade association; membership of a trade union; sexual orientation or practices; or criminal record; health information about an individual; genetic information about an individual that is not otherwise health information; biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or biometric templates.

4. What Personal Information do we collect?

Enquiry and website information

When you book a call: your name, email address, phone number (if provided), company name, the names of any other parties involved, and any brief notes you add. Our booking tool (Microsoft Bookings) also includes an address field. We do not need or use your address for an enquiry, so you may enter only your city or suburb.
When you email us: your contact details and whatever you include in your message.
When you visit the website: our hosting provider keeps standard technical logs, such as IP address and browser type, for security purposes. We use privacy-friendly analytics that do not use cookies. Our interactive tools and template downloads do not require registration, and any figures or answers you enter into our tools stay in your browser's local storage on your device and are not sent to us.

Please keep your initial notes brief and leave out confidential details until we have confirmed there is no conflict of interest.

AML/CTF Information

We are required by law under the AML/CTF Act to collect and verify certain Personal Information and may be prohibited from providing services if we cannot do so.

In particular, we collect KYC Information as required by the AML/CTF Act which may include your full name and any other names you use; date of birth; residential and postal address; contact details; occupation or business; citizenship and country of residence; identity document details (type, number, issuer and expiry) and copies; images taken during video identity verification; identity verification results (if we use a provider); your role in, and ownership or control of, a company, trust or partnership; if you are a company director, your director identification number; whether you are a politically exposed person or a person designated for sanctions; the results of sanctions, PEP and adverse media searches; the nature and purpose of the services; information about the source of funds and source of wealth (where enhanced customer due diligence is required); and records of our dealings and transactions with you.

We may infer information about you from your engagement with us and your activities. We may also collect Sensitive Information where required for compliance with the AML/CTF Framework or where otherwise permitted by law. For example, PEP checks may reveal political roles or associations, adverse media searches may reveal information about a criminal record, and membership of a professional or trade association may be used to verify your occupation.

We may conduct ongoing monitoring of transactions and client information to comply with our AML/CTF obligations.

5. How do we collect Personal Information?

We collect Personal Information only by lawful and fair means.

We will collect Personal Information directly from you unless it is unreasonable or impracticable to do so, for example where the AML/CTF Framework requires us to verify information using third-party sources such as public registers or screening databases.

We may collect Personal Information when you, your organisation, or those acting on your or your organisation's behalf:

use this website or book a call with us;
meet with us in person or by video conference, including a video identity verification meeting (at which, with your consent, we may take a screenshot of you holding your identity document);
communicate with us, including by physical post, email, social media, telephone or text message;
engage us to provide services including when you supply KYC Information in response to our direct request.

AML/CTF Information: other sources, electronic verification and biometrics

We may also collect Personal Information about you from other sources where the AML/CTF Framework requires or permits it, including: a person acting on your behalf; a company, trust or partnership you are connected with (for example, as a director, shareholder, trustee, beneficiary or partner); public registers and records (such as ASIC registers, ABN Lookup, the ACNC register, the DFAT Consolidated List and court records); internet and media searches; and, if we use one, an identity verification provider.

If we use a credit reporting body for electronic identity verification, before we do so we will tell you: why we are asking it to verify your identity; the Personal Information we may give it (your name, residential address and date of birth); that we may ask it to assess whether that information matches information it holds; that it may prepare and give us that assessment; and that it may use your information, and the names, residential addresses and dates of birth of other individuals it holds, to prepare the assessment. We will do so only if you expressly agree, and we will offer you an alternative means of verification (for example, checking your identity document at a video or in-person meeting, or certified copies). If we can't verify your identity having regard to the assessment, we will tell you in writing, name the credit reporting body and offer you an alternative means of verification. We keep a record of the request and the assessment until the end of the first 7-year period, starting after the request, throughout which we have not provided any designated service to you, and we then delete it. You can ask us for access to that record (AML/CTF Act ss 35A–35G).

If an identity verification provider uses facial biometrics (for example, matching a selfie to your identity document), we will ask for your consent first, because biometric information is Sensitive Information.

We will provide you with a collection notice at or before the time we collect your AML/CTF Information. Our collection notice is set out in the Annexure to this Privacy Policy and is given to you with our client information request.

6. What happens if you don't provide us with requested Personal Information?

If you do not provide requested Personal Information, we may be unable to respond to your enquiry, provide Designated Services and/or comply with our legal obligations.

7. Purposes of collection of Personal Information

Enquiry and website information

We use enquiry and website information to check for conflicts of interest, respond to your enquiry, arrange and hold your call, prepare a fixed-fee quote, and keep our website secure. We do not sell or trade Personal Information, and we do not add your booking or enquiry details to any mailing list.

AML/CTF Information

We collect and use Personal Information to carry out our activities and functions including providing you with Designated Services, complying with our regulatory obligations in relation to the delivery of those services, including adherence to the Legal Profession Uniform Law and its related rules and legislation, the Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 (NSW) and the Legal Profession Uniform General Rules 2015 (NSW). In particular, we use Personal Information to meet our obligations under the AML/CTF Framework, including: identifying and verifying our clients and connected persons; assessing and managing money laundering, terrorism financing and proliferation financing risks; ongoing monitoring; reporting to AUSTRAC; record keeping; and independent evaluation of our AML/CTF program. We also use it to comply with Australian sanctions laws (Autonomous Sanctions Act 2011 (Cth) and Charter of the United Nations Act 1945 (Cth)).

Unless you consent to us doing so otherwise, we will only use your AML/CTF Information for the primary purpose for which it was collected, and for any secondary purpose if you would reasonably expect, and the purpose is related to, the primary purpose of collection. Examples of secondary purposes you might reasonably expect are listed in the previous paragraph.

In the case of Sensitive Information, any secondary purpose will be one that you would reasonably expect and directly related to the primary purpose of collection. We do not use Personal Information collected for AML/CTF purposes for direct marketing.

8. Disclosure of Personal Information

Third parties

Subject to legal requirements, we do not share your Personal Information with any third parties except:

with your express permission;
to contracted service providers to organise or facilitate the efficient and effective administration, management or delivery of our services. These include Microsoft 365 (Bookings, Teams and Outlook), which we use to run our calendar, video calls and email, and Cloudflare, which hosts our website. This may also include service providers that support our due diligence processes associated with complying with our AML/CTF obligations. These include our IT, email, cloud storage, video-conferencing and e-signing providers and, if we use one, an identity verification provider; and
to the independent evaluator of our AML/CTF program (required by the AML/CTF Rules), our professional indemnity insurer and our professional advisers, under obligations of confidentiality.

We will ensure that such service providers commit to protecting your Personal Information appropriately and agree not to use or disclose your Personal Information for any other purpose (other than as required by law).

Legal requirements

We may use or disclose your Personal Information in circumstances where required by law and/or expressly permitted by the Privacy Act, including if:

it is not reasonable or practical to obtain consent and we reasonably believe use or disclosure is necessary to lessen or prevent a serious threat to life, health, or safety of any individual or public health and safety;
we have reason to suspect that unlawful activity or misconduct of a serious nature that relates to our activities or functions is being or has been engaged in, and we believe the collection, use or disclosure is necessary to take appropriate action in relation to the matter;
we reasonably believe that the collection, use or disclosure is reasonably necessary to assist with the location of a person reported missing; or
we are compelled by law including:
- by warrant or subpoena;
- where we are required by request under statute or lawful order of a government agency or authority including law enforcement, courts and tribunals and regulators; and/or
- to AUSTRAC and other government agencies without your knowledge or consent, including where we form a suspicion about a matter or transaction under the AML/CTF Framework.

Nothing in this Privacy Policy limits our obligations of confidentiality or client legal privilege. However, there may be circumstances where we are compelled to disclose confidential information to AUSTRAC under the AML/CTF Framework.

We may be prohibited from telling you about disclosures to AUSTRAC or to other government agencies or authorities.

Business transactions

If we are involved in a merger, acquisition or asset sale, your Personal Information may be disclosed in confidence as part of a due diligence process and may be transferred to the new owner. We will provide notice before your Personal Information is transferred and becomes subject to a different Privacy Policy.

9. Can your Personal Information be accessed offshore?

We generally hold your Personal Information in Australia. However, some of our service providers may store or process it overseas, as described below.

We use cloud-based software (email, document storage, video-conferencing, e-signing, call booking and website hosting) to manage our practice and provide our services. Some of these providers may store or process Personal Information on servers outside Australia. We do not enter identity documents or customer due diligence information into AI tools. Where we use business AI tools for drafting or research, their terms prevent use of inputs for training.

We take reasonable steps to ensure that offshore service providers handle your information in a way that is consistent with Australian privacy law. However, once your information is held offshore, it may be subject to the laws of that country, including laws that allow government agencies in that country to access it. Before we disclose your AML/CTF Information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to it (APP 8.1). If an overseas recipient does something with your AML/CTF Information that would breach the APPs, we are accountable for it as if we had done it (s 16C of the Privacy Act).

These providers may store or process Personal Information on servers in the United States and Ireland. Please ask us if you would like more information about the offshore providers we use.

10. How do we protect your information?

We hold Personal Information in hard copy and electronic formats. We take reasonable steps to prevent unauthorised access, disclosure, alteration, destruction or loss of Personal Information including by using a range of physical, operational and technological security measures to protect this information. These measures include organisational and technical measures such as:

training for the principal (and any staff we engage) on their privacy obligations when handling your Personal Information;
administrative and technical controls to restrict access to Personal Information to only those people who need access;
technological security measures, including multi-factor authentication, encryption, firewalls and anti-virus software; and
locked storage for any hard copy records, and secure destruction of records we no longer need.

Where a data breach involving AML/CTF Information is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme in the Privacy Act, including notifying the OAIC and affected individuals, as required.

11. How long do we keep your information?

When we consider that Personal Information is no longer needed for any purpose for which the information may be used or disclosed in accordance with this Policy and that we are not required by law or court order to retain the Personal Information, we will take reasonable steps to destroy or de-identify the information.

Information	How long we keep it
Enquiries where you do not engage us	Up to 7 years, so we can check for conflicts in future, and then we delete it (unless we have started customer due diligence, in which case the AML/CTF periods below apply).
Client files	For the period required by our professional record-keeping obligations (generally 7 years).
Customer due diligence records (including KYC Information)	Until 7 years after the business relationship ends or, for a one-off service, 7 years after we complete the service. For a prospective client we decide not to act for, 7 years after we make that decision.
Documents a client or their representative gives us about a service	7 years after they were given.
Records of electronic verification through a credit reporting body	As set out in section 5 (AML/CTF Act ss 35A–35G).

Where more than one of these rules applies, we keep the record for the longer period. The AML/CTF periods follow the AML/CTF Act (ss 108 and 111) and our AML/CTF program.

12. How you can access and correct your Personal Information

You can ask to see or correct the Personal Information we hold about you, or ask any privacy question, by contacting our Privacy Officer.

For AML/CTF Information, we will respond to inquiries from an individual regarding whether we hold any Personal Information relating to that individual and will allow access to and correction of any such Personal Information subject only to the conditions and limitations set out in the Privacy Act (APP 12 and APP 13), including:

if we reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety;
giving access would have an unreasonable impact on the privacy of other individuals;
the request for access is frivolous or vexatious;
the information relates to existing or anticipated legal proceedings between the organisation and the individual, and would not be accessible by the process of discovery in those proceedings;
giving access would reveal the intentions of the organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations;
giving access would be unlawful;
denying access is required or authorised by or under an Australian law or a court/tribunal order;
the organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the organisation's functions or activities has been, is being or may be engaged in and giving access would be likely to prejudice the taking of appropriate action in relation to the matter;
giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
giving access would reveal evaluative information generated within the organisation in connection with a commercially sensitive decision-making process.

We deal with requests about enquiry and website information in the same way, as a matter of practice.

If you believe that the Personal Information we, or our contracted third party, hold about you is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you may request that we correct it by contacting our Privacy Officer. We may ask you to verify your identity before giving you access or making corrections, and we may charge a reasonable fee for providing access (but not for making a correction).

You can contact our Privacy Officer by email at [email protected].

We will take reasonable steps to correct your information to ensure it is accurate, complete, and up-to-date within a reasonable period (usually within 30 days) of receiving your request. If we refuse to give you access to or to correct your Personal Information, we will give you a written notice setting out the reasons for the refusal (except to the extent it would be unreasonable to do so) and how you can complain about the refusal. If we refuse to correct your Personal Information, you may also ask us to associate with the information a statement that you believe it is inaccurate, out-of-date, incomplete, irrelevant or misleading, and we will take reasonable steps to do so in a way that is apparent to users of the information.

13. How you can complain about our information handling practices

All privacy-related inquiries and complaints are handled by our Privacy Officer. If you have any concerns regarding our management of your Personal Information, or if you believe we have breached the APP/s, please contact our Privacy Officer in writing setting out the details of your complaint.

We are committed to achieving a fair and equitable resolution of any privacy concerns. When you lodge a complaint, we will follow this internal review process:

We will acknowledge receipt of your written complaint within a reasonable time (usually within seven days).
Our Privacy Officer will conduct an internal investigation into your complaint. This will involve reviewing the circumstances of the collection, use, or disclosure of your information and assessing our compliance with our internal procedures and the Privacy Act. We may contact you to request further information to assist with our investigation.
We will endeavour to complete our investigation and provide you with a written response outlining the outcome of our review, our decision, and any corrective actions we propose to take within 30 days of receiving your complaint.

If your complaint relates to AML/CTF Information and you are not satisfied with our response, or if we do not resolve your complaint within 30 days, you are entitled to escalate your complaint by lodging a complaint with the Office of the Australian Information Commissioner (OAIC) at this link: https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us.

If you require a copy of this Privacy Policy in a particular form (e.g. large print, accessible PDF) please contact our Privacy Officer.

Annexure

Annexure – Privacy collection notice for customer due diligence

This privacy collection notice from Cloudberry Law (ABN 25 687 587 840) outlines why we collect your personal information, what we collect, how we collect it and who we share it with.

Why we need to collect your information

We collect your personal information to comply with the customer due diligence requirements in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). This includes to: establish and verify your identity before providing certain services to you or the person or entity you are acting on behalf of; assess and manage potential money laundering, terrorism financing, proliferation financing or related compliance risks associated with our services; make reports required by law under the AML/CTF Act; and meet our record keeping obligations under the AML/CTF Act.

What personal information we collect

We collect: your full name, any other names, date of birth and residential address; contact details; occupation or business; photo ID and a unique identifier, such as your passport or driver licence number, and a copy of your identity documents; images taken during a video identity verification meeting (with your consent); your role in, and ownership or control of, any company, trust or partnership involved (and, if you are a company director, your director identification number); and information about the nature and purpose of the services. Where enhanced due diligence is required, we also collect information about your source of funds and source of wealth.

We also collect the following sensitive information: whether you hold, or have held, a prominent public position or are a member of a political association (to determine whether you are a politically exposed person); membership of professional or trade associations (to verify your occupation); information about criminal matters that may appear in public records or media searches; and, if we use an identity verification provider that uses face matching, biometric information (only with your consent).

How we collect your information

We will generally collect your personal information directly from you: through our onboarding form, by email, and at a video (or in-person) meeting. We may also collect it from: a person acting on your behalf; a company, trust or partnership you are connected with; public registers and records (such as ASIC registers, ABN Lookup, the ACNC register, the DFAT Consolidated List and court records); internet and media searches; and, if we use one, an identity verification provider (we will tell you its name before we use it).

Who we may share your information with

We usually disclose your identity and customer due diligence information to: our IT, cloud storage, video-conferencing and e-signing providers, for storing and processing it; an identity verification provider, if we use one, for verifying your identity; and the independent evaluator of our AML/CTF program, for the evaluation the AML/CTF Rules require.

We may also share your personal information with AUSTRAC to meet our legal and regulatory obligations under the AML/CTF Act or the AML/CTF Rules, and with other Australian government agencies where the law requires us to. We are not part of an AML/CTF reporting group. Some of our service providers may store or process your information outside Australia, in the United States and Ireland (see “Can your Personal Information be accessed offshore?” in this Privacy Policy).

What happens if we cannot collect your information

If you do not provide us with your personal information, we may not be able to verify your identity and provide you (or the person or entity you are acting on behalf of) with the services you have requested. If you prefer not to use a video meeting, or an identity verification provider, we can verify your identity at an in-person meeting instead.

Your privacy rights and our privacy policy

Our Privacy Policy contains further information about how we will handle your personal information and how you can access and correct it. It also explains how to lodge a complaint and how we will manage it if you are concerned about how we have handled your information. Our Privacy Policy is available at cloudberrylaw.com.au/privacy or free of charge on request.

How to contact us about your privacy

Privacy Officer, Cloudberry Law. Email: [email protected].