Evergrowth Consulting — Privacy Statement

Last reviewed: August 2026 (v2026.08-3)

1. Our Commitment to Your Privacy

Evergrowth Consulting (“we,” “us,” “our,” “the Firm”) is committed to protecting the privacy of your personal information.

As a small business operator under s 6D of the Privacy Act 1988 (Cth) (Privacy Act), with annual turnover of less than $3 million, we are not automatically bound by the Australian Privacy Principles (APPs) in Schedule 1 to the Privacy Act, and we have not opted in under s 6EA. We have, however, voluntarily chosen to handle personal information consistently with the APPs and with the Notifiable Data Breaches (NDB) scheme as a matter of professional best practice and to demonstrate our commitment to protecting your personal information.

As a registered tax practitioner, we comply with the confidentiality obligations in Code Item 6 of the Tax Agent Services Act 2009 (Cth) (TASA), which prohibits disclosure of client affairs to a third party without the client’s permission or a legal duty to do so. Our handling of Tax File Number (TFN) information is separately and always governed by the Privacy (Tax File Number) Rule 2015 (TFN Rule), which applies to all registered tax agents regardless of business size or small-business-exemption status, and by ss 8WA–8WB of the Taxation Administration Act 1953 (Cth) (TAA).

We have completed enrolment with AUSTRAC under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) as part of the “Tranche 2” reforms that took effect from 1 July 2026. Following completion of that enrolment process, we have confirmed that we are not a reporting entity providing designated services under the AML/CTF Act, and we are therefore not currently subject to the ongoing AML/CTF program, customer due diligence, or reporting obligations that apply to reporting entities. We will review this position periodically and update this statement if our services or AUSTRAC status change.

2. What Personal Information We Collect and Hold

We collect and hold personal information reasonably necessary to provide accounting, taxation, advisory and compliance services, including:

Full name, date of birth, residential and postal address, contact details
ABN and TFN (see section 5 for TFN-specific obligations)
Financial information (income, assets, liabilities, superannuation, bank details)
Employment details and payroll records
Company, trust and partnership details, including beneficial ownership information where relevant to our services
Records confirming that identity verification has been completed (e.g., the type of identification document sighted, the date and method of verification), collected for client identification purposes as described in section 5A. Consistent with TPB and ATO guidance, we do not retain copies of the identification documents themselves once verification is complete.
Information about representatives, employees, beneficiaries or associates where necessary to deliver services

Sensitive information (health information relevant to superannuation/insurance advice, or criminal history where required by law) is collected only with consent or where otherwise permitted or required by law. We do not knowingly collect information from persons under 18 without parental/guardian consent.

3. How We Collect Personal Information

Directly from you — engagement letters, onboarding forms, meetings, phone, email, website, or client portal
Via our identity verification provider, BGLiD, as described in section 5A
From third parties with consent or as permitted by law — ATO, ASIC, state revenue offices, employers, financial institutions, referring advisers
From public registers — ABN Lookup, ASIC Connect, land title registers
Automatically via our website — usage data, IP addresses, cookies (see section 9)

Where practicable, we will notify you at or before collection of the matters required by APP 5. Unsolicited personal information that we could not have collected under APP 3 will be destroyed or de-identified as soon as practicable (APP 4).

4. Purposes for Collecting, Holding, Using and Disclosing Personal Information

We collect, hold, use and disclose personal information to:

Provide accounting, taxation, bookkeeping, advisory and compliance services
Prepare and lodge tax returns, activity statements and other statutory filings
Verify your identity in accordance with our obligations as a registered tax practitioner (see section 5A)
Administer the client relationship, including invoicing and communications
Comply with legal obligations under TASA, the Privacy Act, the TFN Rule, and the Corporations Act 2001 (Cth)
Respond to complaints and queries; maintain quality and professional development

We do not sell personal information to third parties.

5. Tax File Number (TFN) Information

TFN handling is subject to strict obligations under the Privacy (Tax File Number) Rule 2015 and ss 8WA–8WB of the TAA, which apply irrespective of the Firm’s small-business status:

TFN information is collected only where authorised by taxation, personal assistance, or superannuation law
Used or disclosed only for authorised purposes; access restricted to staff who need it
Never transmitted via unencrypted or unsecured email; secure portal, password protection or encryption used where electronic transmission is necessary
Securely destroyed or de-identified when no longer required by law
A breach of the TFN Rule is an interference with privacy under the Privacy Act; unauthorised use/disclosure may also constitute an offence under s 8WB TAA, attracting imprisonment and monetary penalties

5A. Client Identity Verification (BGLiD)

As a registered tax practitioner, we are required to take reasonable steps to verify the identity of clients and, where applicable, their authorised representatives, in accordance with Tax Practitioners Board Guidance Statement TPB(GS) 42/2022 (Proof of identity requirements for client verification) and the Australian Taxation Office’s agent client verification methods. To meet these obligations, we use BGLiD, a third-party digital identity verification service, to sight and verify identification documents (which may include a driver’s licence, passport, or other government-issued identification) and, where applicable, biometric facial matching information that you provide for this purpose.

Consistent with TPB and ATO guidance (including TPB(GS) 52/2024, Obligation to keep proper client records), we do not require, recommend, or retain copies or originals of your identification documents once your identity has been verified. Instead, we keep only a record of the verification undertaken — such as the type of document sighted, the date, and the method of verification — for the retention period described in section 7. Any document images or biometric data temporarily processed by BGLiD for the purpose of the verification check are handled and, where applicable, destroyed by BGLiD in accordance with its own published privacy policy and retention practices, and are not stored by us.

BGLiD’s role in our practice is limited to satisfying these TPB and ATO client verification requirements. We are not currently a reporting entity under the AML/CTF Act (see section 1), and BGLiD is not used by us for AML/CTF customer due diligence or know-your-customer purposes.

6. Disclosure of Personal Information to Third Parties

Recipient Category	Purpose
Australian Taxation Office (ATO)	Lodgment of returns, activity statements, correspondence
ASIC, APRA, state/territory revenue offices	Statutory filings and compliance
BGLiD	Client identity verification to satisfy TPB and ATO requirements (see section 5A)
Outsourced bookkeeping / specialist providers	Service delivery under confidentiality obligations
Cloud computing and document management providers (see section 6B)	Secure data storage and practice management
AI tools (Perplexity AI, Google Gemini, ChatGPT, Microsoft Copilot)	Research, drafting and document preparation assistance, subject to safeguards in section 6C
Your authorised representatives or referral advisers	At your direction and with consent
CPA Australia / Chartered Accountants ANZ	Practice quality review, per their published privacy policies
Courts, tribunals, law enforcement	Where required by law, court order or subpoena

We take reasonable steps to ensure third-party providers handle personal information consistently with the APPs and, where applicable, the TFN Rule.

6A. Disclosure of Personal Information Overseas

We may use cloud services with servers located overseas, including Microsoft 365 and Google Drive backup infrastructure, which may involve data replication in the United States and Asia-Pacific regions. Before any such overseas disclosure, we take reasonable steps to ensure the overseas recipient does not breach the APPs; where we cannot take such steps, we seek your consent or rely on a legal requirement. Contact us (section 12) for details of the specific countries involved.

6B. Data Storage and Security Providers

We hold and process information using Microsoft 365, Google Drive (backup), MYOB Practice Management (client portal, AWS Sydney region), and our locally hosted server maintained by our engaged IT provider. Overseas-linked providers are contractually required to maintain security standards equivalent to Australian requirements, use encryption in transit and at rest, and provide breach notification procedures.

6C. Use of Artificial Intelligence (AI) Tools

We use AI tools — including Perplexity AI, Google Gemini, OpenAI ChatGPT and Microsoft Copilot — to assist with research, drafting and document preparation. Where used in delivering tax agent or BAS agent services, AI output is treated as a productivity aid only and is reviewed by a suitably qualified team member before being relied upon, consistent with the TASA Code of Professional Conduct and TPB Guidance Statement TPB(GS) 55/2026. Entering client information into an AI tool may constitute disclosure to a third party under Code Item 6 of the TASA Code; by engaging our services and accepting our engagement letter (or separate signed consent), you provide permission for this on the basis that we take reasonable steps to protect confidentiality, including avoiding TFNs in free/public consumer AI tools and preferring enterprise/firm-configured versions.

We do not use AI or other automated systems to make decisions that significantly affect your rights or interests without human involvement. From 10 December 2026, new APP 1.7–1.9 disclosure requirements regarding automated decision-making take effect under the Privacy and Other Legislation Amendment Act 2024 (Cth); we will update this statement accordingly if our practices change.

7. How We Hold and Protect Personal Information

Security measures include password-protected and encrypted systems with role-based access, multi-factor authentication, a secure client portal, physical security for paper records, staff privacy/TFN training, a documented Data Breach Response Plan (section 8), and regular review of security controls. We retain personal information only as long as necessary for its purpose and our legal obligations; under Tax Practitioners Board (TPB) requirements we retain tax agent service records, including records confirming that client identity verification has been completed via BGLiD (but not copies of the identification documents themselves), for a minimum of 5 years. Once retention obligations lapse, information is securely destroyed or de-identified.

8. Notifiable Data Breaches (NDB) Scheme

As a small business operator under s 6D of the Privacy Act, we have not opted in under s 6EA and are not automatically subject to the mandatory Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. However, as a matter of voluntary best practice, where a data breach occurs that is likely to result in serious harm to any individual, we follow a response process consistent with the NDB scheme, including that we will:

Contain the breach as quickly as possible
Assess the risk to affected individuals
Notify affected individuals as soon as practicable
Notify the Office of the Australian Information Commissioner (OAIC) on a voluntary basis, consistent with best practice (noting we have not opted in under s 6EA and are not automatically subject to mandatory OAIC reporting)
Notify the ATO via the Client Identity Support Centre (1800 467 033) where tax practitioner data is involved
Take steps to prevent future breaches and document our response

The Privacy and Other Legislation Amendment Act 2024 (Cth), assented to 10 December 2024, introduces expanded OAIC enforcement powers (civil penalties and infringement notices) and a statutory tort for serious invasions of privacy. New automated decision-making disclosure obligations under APP 1.7–1.9 commence 10 December 2026.

9. Website and Online Services

We may automatically collect IP address, browser type, pages visited, time of visit, referring address, and information submitted through contact/enquiry forms. This data improves our website and communications and is not used to identify you personally unless you submit details directly. Cookies may be used to improve user experience; you may disable them in your browser, noting some functionality may be affected.

10. Your Rights — Access and Correction

You may request access to and correction of personal information we hold, consistent with APPs 12–13. Contact our Privacy Officer (section 12); requests are verified for identity and responded to within 30 days where possible. Access is generally free, though a reasonable fee may apply for large or complex requests. We may decline access where permitted by law, providing written reasons and complaint information. Correction requests will be actioned with reasonable steps, including notifying third parties who received the information where relevant.

11. Privacy Complaints

Step 1: Contact our Privacy Officer (section 12). We acknowledge complaints within 5 business days and respond substantively within 30 days.

Step 2: If unsatisfied, lodge a complaint with the OAIC (GPO Box 5218, Sydney NSW 2001; Phone 1300 363 992; www.oaic.gov.au/privacy/privacy-complaints), or, for conduct as a registered tax practitioner, the Tax Practitioners Board (www.tpb.gov.au; Phone 1300 362 829).

12. Contact Us — Privacy Officer

Privacy Officer: Ken Huang (Director)

Evergrowth Consulting

Registered Office and Business Address: Unit 22, 573 Burwood Highway, Knoxfield, VIC 3180, Australia

Postal Address: PO Box 4281, Knox City Centre, VIC 3152

Phone: +61 3 9887 0777

Email: info@evergrowthconsulting.com.au

13. Changes to This Privacy Statement

We review and update this Privacy Statement periodically to reflect changes in our practices and the law. The current version is published on our website and available free in paper form on request, consistent with APP 1.5–1.6. We encourage regular review of this page; where changes are material, we will take reasonable steps to notify existing clients.

Prepared with reference to: Privacy Act 1988 (Cth) Sch 1 (APPs) and s 6D; Privacy (Tax File Number) Rule 2015; Tax Agent Services Act 2009 (Cth) s 30-10; Taxation Administration Act 1953 (Cth) ss 8WA–8WB; AML/CTF Act 2006 (Cth); Privacy and Other Legislation Amendment Act 2024 (Cth); Tax Practitioners Board Guidance Statement TPB(GS) 42/2022 (Proof of identity requirements for client verification); TPB(GS) 52/2024 (Obligation to keep proper client records); ATO agent client verification methods; OAIC guidance materials; EGC Standards/EGC information.txt (firm registration and turnover confirmation).