1. Our commitment
1.1Benson & Gray is a specialist consulting practice. We handle personal information with the same care and discretion we bring to our clients’ systems.
1.2This policy explains how we collect, use, disclose and protect personal information, and how you can access or correct it or make a complaint. We have chosen to handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
1.3This policy doesn’t cover personal information that our clients give us access to while we deliver services to them (for example, employee data within a client’s payroll or workforce systems). That information is handled under our agreement with the client and the client’s own privacy policy, with strict access, minimisation and confidentiality controls. If your information is held by one of our clients, please contact that organisation first.
2. What we collect
2.1Depending on how you deal with us, we may collect:
- contact details: your name, organisation, role, work email address and phone number;
- enquiry details: the type of conversation you request, preferred days or times, your timezone, and anything you choose to tell us about your situation;
- relationship details: correspondence, meeting notes, proposals, contracts, invoices and payment records;
- website information: limited technical information such as your IP address and browser type, which is processed when your browser connects to our website and its service providers (see section 9);
- recruitment information: CVs, qualifications, work history and referee details, if you apply to work with us or as a specialist; and
- supplier and partner information: contact and business details of specialists, partners and suppliers we work with.
2.2We don’t ask for sensitive information (such as health information, racial or ethnic origin, or political opinions) through our website. Please don’t include it in an enquiry. If sensitive information is genuinely needed, for example in a recruitment process, we’ll collect it only with your consent and where reasonably necessary.
2.3Please don’t send us passwords, credentials, production data or other people’s personal information through our website or by email. If an engagement needs access to systems or data, we’ll agree a secure method with you.
3. How we collect it
3.1We collect personal information directly from you where reasonably practicable: when you send us an enquiry through our website, email or call us, meet with us, attend an event, or engage us. Our website’s enquiry form prepares an email in your own mail app; the website itself doesn’t store what you enter.
3.2We may also collect it from third parties, such as a colleague who introduces you, a partner who refers your organisation with your knowledge, recruitment referees, or publicly available sources such as your organisation’s website or professional networking profiles.
3.3You can deal with us anonymously or using a pseudonym for general enquiries, where that’s practicable. We’ll need your real details to arrange a meeting, provide services or enter a contract.
4. Why we collect and use it
4.1We collect and use personal information to:
- respond to enquiries and arrange the conversations you request;
- understand your needs, prepare proposals and deliver our services;
- manage our client, partner and supplier relationships, including contracts, invoicing and payment;
- send you insights or updates where you have agreed to receive them (see section 6);
- operate, secure and improve our website;
- assess applications to work with us;
- meet our legal, regulatory, insurance and professional obligations; and
- protect our rights, and the security of our systems and the systems we access for clients.
4.2We won’t use your personal information for an unrelated purpose unless you consent or the law permits it.
5. Who we share it with
5.1We don’t sell personal information. We may disclose it to:
- service providers who help us run our business, such as hosting, email, scheduling, customer-relationship management, accounting, document storage and AI-assisted productivity providers;
- specialists and subcontractors who work with us on an engagement, under written confidentiality and data-handling obligations;
- our professional advisers, insurers and financiers, under confidentiality;
- a partner or other provider you or your organisation ask us to introduce you to, with your knowledge;
- a purchaser or successor if all or part of our business is sold or restructured; and
- government agencies, regulators or courts where required or authorised by law.
5.2We require our service providers and specialists to protect personal information and to use it only for the services they provide to us.
6. Marketing
6.1We’ll only send you marketing emails, such as insights or updates, if you’ve agreed to receive them or the law otherwise permits it. Opting in is always separate from making an enquiry.
6.2Every marketing email will identify us and include a working unsubscribe option, as required by the Spam Act 2003 (Cth). You can also opt out at any time by contacting us. We’ll action opt-outs within 5 business days.
6.3Service messages about an enquiry or engagement aren’t marketing, and you’ll still receive them if you opt out of marketing.
7. Overseas disclosure
7.1Some of our service providers store or process information outside Australia. Where we can choose, we use Australian data-centre regions for our primary business systems.
7.2The countries in which recipients are likely to be located include the United States.
7.3Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual commitments.
8. Artificial intelligence tools
8.1We use business-grade AI tools, including our AI Executive Assistant, Dante, to help us draft, summarise and analyse information, for example to prepare meeting notes. We use only services configured so that your information isn’t used to train public AI models, and a person reviews anything we rely on.
8.2We don’t put client systems data, credentials or sensitive information into AI tools that aren’t approved for that information.
9. Cookies and website analytics
9.1Our website doesn’t set cookies and doesn’t currently use analytics.
9.2Our fonts are provided by Google Fonts, so when you visit the website your browser connects to Google’s servers, which receive your IP address and browser information. We don’t use advertising or cross-site tracking cookies.
9.3If we introduce analytics in future, we’ll choose a privacy-friendly service and update this policy first.
10. Keeping information secure
10.1We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include access controls and multi-factor authentication, encryption where available, secure business devices, least-privilege access for our people and specialists, and secure credential handling.
10.2No system is completely secure. If you think your information has been compromised, please contact us straight away.
10.3If a data breach is likely to result in serious harm, we’ll assess it promptly and notify affected individuals and, where required, the Office of the Australian Information Commissioner.
11. How long we keep it
11.1We keep personal information only for as long as we need it for the purposes in this policy, or as required by law (for example, financial records are generally kept for at least five years).
11.2When we no longer need it, we take reasonable steps to destroy or de-identify it. Information held in backups is deleted through the normal backup cycle and isn’t restored for other purposes.
12. Accessing and correcting your information
12.1You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer.
12.2We’ll respond within 30 days. There’s no charge for making a request. We may charge a reasonable fee for providing access in some cases, and we’ll tell you before incurring it.
12.3If we refuse access or correction, we’ll explain why in writing (unless that would be unreasonable) and tell you how to complain.
13. Questions and complaints
13.1If you have a question or complaint about how we’ve handled your personal information, please contact our Privacy Officer at [email protected].
13.2We’ll acknowledge your complaint promptly and aim to resolve it within 30 days.
13.3If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
14. Changes to this policy
14.1We may update this policy from time to time. The current version will always be on our website, with the date it was last updated.
15. Contact us
Privacy Officer, Benson & Gray Pty Ltd
Email: [email protected]