Privacy Policy

Liberate Consulting Pty Ltd ("Liberate Consulting", "we", "us", "our") helps Australian financial services firms — including AFSL holders, wealth managers, and advisers — design, govern, and operate AI systems that are secure, transparent, and compliant.

This policy explains how we collect, use, disclose, and protect personal information across all of our channels and engagements, including:

• Visits to liberateconsulting.com and any subdomains we operate
• Contact forms, enquiries, demo requests, and consultation bookings
• Mailing lists, lead magnets, and event invitations
• AI Governance Workshops (including AFSL-focused half-day sessions)
• AI Discovery & Strategy engagements and other consulting work
• Purchases made through our online checkout

We are committed to handling personal information in compliance with:

• The Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth), and the 13 Australian Privacy Principles (APPs)
• The EU General Data Protection Regulation (GDPR) and UK GDPR, where applicable
• APRA prudential standards CPS 230 (Operational Risk Management) and CPS 234 (Information Security), to the extent our work touches APRA-regulated entities

This policy is available free of charge on our website. If you need it in an alternative format, please contact us using the details in Section 15.

Personal information has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable. This broadly corresponds to "personal data" under the GDPR.

Sensitive information means the categories of personal information listed in the Privacy Act, including health information and information about racial or ethnic origin, political opinions, religious beliefs, sexual orientation, and criminal record. We do not collect sensitive information unless you provide it voluntarily or the law permits.

Automated decision-making (ADM) means a decision made or materially supported by a computer program using personal information. An ADM Register is the inventory of those systems, which we help clients build and maintain.

Client engagement materials means documents, system exports, screenshots, configuration data, transcripts, and any other artefacts a client provides us during an engagement.

APP entity means an organisation or agency bound by the Australian Privacy Principles under the Privacy Act, which includes Liberate Consulting.

We collect different categories of personal information depending on how you interact with us. We collect only the information that is reasonably necessary for the relevant purpose (APP 3).

We collect personal information directly from you wherever it is reasonable and practicable to do so (APP 3.5), through our website, email, phone calls, workshops, document exchanges, and engagement portals.

Where we collect information from a third party, we will notify you at or before our first contact, unless notification is inconsistent with our legal obligations or a permitted exception under the APPs applies.

We collect personal information only where it is reasonably necessary for one or more of the purposes described in Section 5, or where you have consented (APP 3).

We use personal information only for purposes that are directly related to our functions and activities, or for purposes you would reasonably expect (APP 6). Specifically, we use it to:

• Respond to enquiries and provide quotes, proposals, and consultations
• Deliver our services: AI Governance Workshops, AI Discovery & Strategy engagements, advisory work, and bespoke deliverables
• Maintain client records, billing, and engagement files
• Send service updates and, where you have opted in, marketing communications, event invitations, and newsletters
• Improve our website, services, and content
• Operate our internal business: security monitoring, training, quality assurance, and professional indemnity
• Comply with our legal, regulatory, and professional obligations

We will not use your personal information for a secondary purpose unless you have consented, or the use falls within a permitted general situation under the Privacy Act.

We disclose personal information only where it is necessary to deliver our services or comply with the law (APP 6). Recipients include:

• Our personnel — employees, contractors, and associate consultants engaged on your matter, all bound by written confidentiality obligations
• Sub-processors / service providers — website hosting, cloud storage, productivity tools (e.g. Google Workspace), email marketing platforms, CRM, scheduling, video conferencing, and our payment processor
• Professional advisers — accountants, auditors, lawyers, and our professional indemnity insurer
• Regulators and authorities — where required by law, court order, or a regulator's lawful direction
• A business purchaser — in connection with any sale or restructure of Liberate Consulting, subject to confidentiality protections

We do not sell personal information.

A current list of key sub-processors is available on request from privacy@liberateconsulting.com.

Some of our service providers store or process personal information outside Australia, including in the United States and the European Union.

Before disclosing personal information overseas, we take reasonable steps to ensure the overseas recipient handles the information consistently with the APPs (APP 8.1). We do this through:

• Contractual data-protection terms with sub-processors (including, where applicable, Standard Contractual Clauses for EEA/UK transfers)
• Where a country or binding scheme is included on the Minister's approved "whitelist" (as introduced by the Privacy and Other Legislation Amendment Act 2024), we may rely on that approval

We do not disclose personal information overseas where we cannot take reasonable steps to ensure APP-equivalent protection.

Specific countries to which we currently disclose personal information, or are likely to disclose, include: United States (cloud infrastructure providers), Ireland / EU (productivity and communication tools). An up-to-date list is available on request.

We protect personal information using administrative, technical, and physical controls (APP 11), including:

• Access controls, multi-factor authentication, and least-privilege access
• Encryption in transit (TLS) and encryption at rest for cloud-stored client material
• Vendor due diligence and written data-protection contracts with sub-processors
• Personnel training on confidentiality, information security, and AI governance
• Documented incident response and breach-notification procedures, aligned with the Notifiable Data Breaches (NDB) scheme

For engagements with APRA-regulated clients, we work to support their obligations under CPS 230 (operational risk management, critical operations, and third-party arrangements) and CPS 234 (information security), including maintaining incident response procedures and notifying clients promptly of incidents that could affect them.

We keep personal information only for as long as we need it for the purposes set out in this policy, or as required by law and professional standards (APP 11.2). When information is no longer needed, we destroy it securely or de-identify it.

Our website uses cookies and similar technologies. We categorise these as follows:

You can manage cookies through your browser settings and, where presented, through our cookie consent banner. Disabling non-essential cookies may affect some site functionality.

We use third-party tools (web analytics, embedded video, and form/booking widgets) that may process limited information about your visit. A current list of third-party processors is available on request from privacy@liberateconsulting.com.

Under the Privacy Act 1988 (Cth) and the APPs, you have the following rights:

We may need to verify your identity before we act on an access or correction request. We will not charge a fee for making a request, but may charge a reasonable cost-recovery fee to provide access to information.

If you are located in the EEA or UK, in addition to the rights in Section 12, you may have the following rights under the GDPR or UK GDPR:

We do not appoint an EU Article 27 representative at this time. To exercise GDPR rights, please contact us directly at privacy@liberateconsulting.com and we will respond within 30 days (or within the statutory timeframe where shorter).

Under this new tort, an individual may bring a civil action against a person who has intentionally or recklessly invaded their privacy by:

• Intruding upon their seclusion (e.g. watching, listening to, or recording their private activities), or
• Misusing information that relates to them

where the individual had a reasonable expectation of privacy, the invasion was serious, and the public interest does not outweigh the individual's privacy interest.

We take this obligation seriously. Our personnel are trained to recognise and avoid conduct that could constitute a serious invasion of privacy. Affected individuals may seek damages, injunctions, or other relief through the courts.

This right is separate from, and in addition to, the right to complain to the OAIC under the Privacy Act.

To make a privacy enquiry, exercise your rights, or lodge a complaint, contact our Privacy Officer:

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. Where a complaint is complex or requires investigation, we will keep you informed of our progress.

If you are not satisfied with our response, you may escalate to:

We may update this policy from time to time to reflect changes in our services, technology, legal obligations, or industry practice. The current version will always be available at liberateconsulting.com/privacy-policy/.

Where changes are material — such as new categories of personal information, new disclosure recipients, or significant changes to individual rights — we will take reasonable steps to bring those changes to your attention before they take effect (for example, by a notice on our website or by email).

The version number and "Last updated" date at the top of this policy indicate when it was last changed. We recommend checking this page periodically.