1.Introduction

Downlaod: Wallis Payne & Co Privacy Policy V3.pdf

1.1.Purpose

Wallis Payne and Co recognises the importance of protecting your privacy. We are committed to respecting your right to privacy and protecting your personal information. We will take reasonable steps to protect personal information collected by us from loss, unauthorised access, misuse and unauthorised disclosure.

Wallis Payne & Co adhere to the Australian Privacy Principles (APPs) and are bound by the Privacy Act 1988 (Cth) (Privacy Act), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth) (POLA Act). It is important to us that personal information collected by us is protected.

If you want more information about this Privacy Policy, or if you want to inquire about any of personal information held by us, or if you believe personal information held by us is inaccurate, incomplete or out-of-date, please contact us.

Our business is providing financial services to retail and wholesale clients. When providing such services, we may have access to personal information relating to our clients.

The purpose of this Privacy Policy is to outline how we collect, use, disclose and retain personal and sensitive information. It also sets out how you can make a complaint and how you can access the personal information we hold about you.

If we change the way we collect or use information about you, we will amend this Privacy Policy and will post the amended version on this site.

2.What is personal information?

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.

2.1.What personal information could we collect?

For us to provide financial services to you, we may collect the following information:

full name, date of birth, contact details and residential address
financial position: assets, liabilities, income, expenses and cash flow
superannuation and insurance details
investment objectives, risk tolerance and time horizon
health and medical information (for insurance advice), estate planning details and family circumstances
tax file number, tax residency and relevant tax information
employment, business activities and source of wealth
identity document details — type, number, issuing authority and expiry
politically exposed person (PEP) status and sanctions screening results

2.2.Collection of personal information

We collect personal information to fulfil our obligations as a licensed financial services provider under the Corporations Act 2001, the Privacy Act and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. This includes our obligations to:

verify your identity before providing financial services (AML/CTF customer due diligence)
provide you with financial advice tailored to your personal circumstances, goals and financial situation
manage your ongoing financial services including portfolio reviews, insurance and superannuation
prepare and deliver Statements of Advice (SOAs) and ongoing advice documents
meet record-keeping obligations under the Corporations Act, AML/CTF Act and ASIC regulatory requirements
make reports required by AUSTRAC under the AML/CTF Act
manage complaints and disputes in accordance with our internal dispute resolution obligations

We may collect and hold personal information from clients for the purposes of enabling us to provide our services. For example - when we provide financial services to clients (eg. when we recommend a financial product or to arrange for clients to invest in a financial product). When doing so, we may collect personal information about them as part of forming our recommendation or providing our arranging services.

If you give us personal information about you, we will only use and disclose that information for the relevant purposes set out below. You can also access the information we hold about you.

Any personal information held by us may be held in several ways including via hard copy, soft copy or offsite on electronic servers.

Where we obtain sensitive information (e.g. racial or ethnic origin, political opinions, religious beliefs or affiliations or criminal record), we will only do so with your consent and where the collection of such information is reasonably necessary for us to perform our function.

2.3.How do we collect your information

We collect your personal information:

directly from you through our fact find, risk profile questionnaire and ongoing correspondence
from third-party sources including financial institutions, superannuation funds, insurers, ATO, public registers (ASIC) and identity verification services, where reasonably necessary

2.4.Dealing with unsolicited personal information

If we receive unsolicited personal information, we will within a reasonable period after receiving the information, determine whether or not we could have collected the information under Australian Privacy Principle 3. If the information could not have been obtained under APP 3, we will take steps to destroy or de- identify the information as soon as practicable, if it is lawful and reasonable to do so.

2.5.Notification of the collection of personal information

At or before the time we collect personal information from you, or if that is not practicable, as soon as practicable after, we will take reasonable steps to ensure you are aware of:

who we are and our details;
how we collect the personal information and whom from;
whether the collection of the personal information is required or authorised by or under an Australian law or a court/tribunal order;
the purposes for which we collect the personal information;
the main consequences (if any) if we do not collect all or some of the personal information;
any other person or body to whom we would disclose the personal information that we have collected;
information about how you may access the personal information held by us about you and how you may seek correction of such information;
how you may complain about a breach of the Australian Privacy Principles and how the entity will deal with such a complaint;
whether we are likely to disclose the personal information to overseas recipients (if so where).

2.6.Anonymity and pseudonymity

Whilst you may wish to deal with us anonymously, this is likely to limit the services we provide to you as our principal business is the provision of financial services which is personal to you. Given the legal requirements around anti-money laundering and counter terrorism financing, we are required to identify our clients when we deal with them. We cannot therefore provide financial services to you on an anonymous basis.

2.7.If clients don’t provide us with the information we request

It is the client’s choice as to whether they wish to provide us with the information we request. However, we may not be able to provide with the services they require if they don’t provide us with the relevant information to help us deliver the services.

3.Use or disclosure of personal information

Personal information collected by us is used to provide financial services to you and will not be disclosed unless required in the performance of those services or otherwise permitted under the Privacy Act. We may disclose your personal information to the following categories of third parties:

Product issuers and platforms — where you invest in a financial product through us, including fund managers, superannuation trustees, insurance companies, managed investment scheme operators, and investment platforms, with your consent;
Paraplanning service providers — who assist in preparing your financial advice documents (including Statements of Advice) on our behalf, whether located in Australia or overseas;
Compliance and audit service providers — who conduct file reviews and compliance monitoring of our advice processes on our behalf, including external compliance consultants engaged by our licensee;
Software and technology providers — including IT, document management, CRM platform providers and practice management system providers who host and manage our client records and systems;
Professional advisers — including your legal, accounting, lending and audit advisers, where you have asked us to liaise with them or where it is necessary to provide you with coordinated financial services;
Our AML/CTF reporting group — as required under our AML/CTF Program;
Regulators — including ASIC, AUSTRAC and the ATO where required by law, court order or in connection with our regulatory obligations; and
Artificial intelligence tools — where we use AI-assisted software to help prepare financial advice documents or record client meetings (see Section 3.3 below).
If we specify that personal information is collected for a specific purpose, we will not use or disclose the information for another purpose unless you consent to the use or disclosure of the information or an exception in the APPs applies.

3.1.Overseas disclosure

Some of our service providers are located overseas or store data on servers outside Australia. This may include, cloud storage and document management platforms, and AI tool providers. Overseas recipients may include, but are not limited to, providers in Singapore, India, the Philippines, New Zealand, and the United Kingdom.

We take reasonable steps to ensure overseas recipients handle your personal information consistently with the Australian Privacy Principles (APPs), including by: (a) entering into contractual arrangements requiring APP-consistent handling; (b) assessing the privacy protections in the recipient country; and (c) relying on the Government's whitelist of approved countries (once published under the POLA Act 2024) where available.

3.2.Direct marketing

We may use and disclose your personal information to keep you informed about the range of services that we think may be relevant or of interest to you. You can opt out of receiving information from us at any time by contacting us.

3.3.Use of artificial intelligence

We may use artificial intelligence (AI) tools to assist in the preparation of financial advice documents (including Statements of Advice), to record and transcribe client meetings, and to assist in the preparation or review of compliance documentation. AI tools currently used by us include Microsoft Copilot. These tools may be hosted by providers located overseas. Where AI tools are used, your personal information including your financial position, goals, personal circumstances and discussion transcripts may be processed by the AI system.

We take reasonable steps to ensure:

where meeting transcription tools are used, clients will be notified before the meeting commences and given the opportunity to decline recording;
human review is applied to all AI-assisted advice outputs before they are provided to clients;
client personal information is not used to train AI models without their consent; and
AI tools used by us are subject to appropriate data handling and confidentiality obligations.

4.Security and access

We take reasonable steps to ensure that all personal data collected is accurate, up to date and complete. You can ask us to correct any inaccurate information we hold or have provided to others by contacting us using the details in this policy. If the information that is corrected is information we have provided to others, you can ask us to notify them of the correction.

4.1.Security of personal information

We take care to protect the security of client personal information. We may hold personal information in a combination of secure computer storage facilities, paper-based files and other formats. We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification or improper disclosure. In accordance with APP 11 as amended by the POLA Act 2024, our security measures include both technical measures (encryption of data at rest and in transit, multi-factor authentication, role-based access controls, regular security testing, and vendor security assessments for all third-party providers) and organisational measures (staff privacy and security training, documented incident response procedures, periodic security reviews, and contractual data security obligations on all third-party service providers including paraplanning and AI tool providers). We regularly review these measures to ensure they remain reasonable in the circumstances.

Please note, we are required by law to retain your personal information for a specific amount of time. We will generally destroy or de-identify personal information if it is no longer required.

4.2.Access to and collection of personal information

You can contact us to access or correct any personal information we hold about you. However, in certain situations, we are permitted to refuse access to personal information. These situations include where:

Providing access would have an unreasonable impact on the privacy of other individuals
Providing access would be unlawful, or where denying access is required or authorised by an Australian law or a court order
Providing access is likely to interfere with law enforcement activities.

For other situations, please consider Australian Privacy Principle 12.

If we receive a request to access personal information, we aim to respond to that request in a reasonable timeframe. In general, we will not impose an access charge unless the request of access and correct personal information is excessively onerous.

If we refuse access to personal information, we will provide you with reasons as to why access was refused and provide you with information on how to lodge a complaint about the refusal.

4.3.Retention of personal information

We retain personal information only for as long as it is required for the purposes for which it was collected, or as required by law. We will take reasonable steps to destroy or de-identify personal information in accordance with APP 11.2 when the personal information we hold is no longer required.

If we are required to hold the personal information, the applicable minimum retention periods for financial advice businesses is seven years.

4.4.Data breach

A data breach occurs when personal information held by us is lost or subjected to unauthorised access, modification, disclosure, or other misuse or interference. Examples of a data breach are when a device containing personal information of clients is lost or stolen, or when a database containing personal information is hacked or if we mistakenly provide personal information to the wrong person.

Under the Privacy Amendment (Notifiable Data Breaches) Act 2017, we have an obligation to assess within 30 days whether a data breach amounts to an ‘eligible data breach’ if we become aware that there are reasonable grounds to suspect that data breach may have occurred.

If we form the view that the data breach would likely result in serious harm to any of the individuals to whom the information relates despite any remedial action taken by us, then the data breach will constitute an ‘eligible data breach’. If an eligible data breach occurs, we have an obligation to notify you and the Office of the Australian Information Commissioner and of the details of the eligible data breach.

5.Complaint

If you would like to make a complaint about this policy or the personal information held by us, please contact us on the contact details below. We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) (see below).

5.1.External Dispute Resolution

If we are not able to satisfactorily resolve your complaint relating to your personal information you can contact The Privacy Commissioner.

Office of the Australian Information Commissioner (OAIC)

GPO Box 5218

Sydney NSW 2001

1300 363 992

privacy@privacy.gov.au

6.Contact us

You may wish to contact us to:

Request access to your personal information
Correct or update your personal information
Opt out of direct marking communications
Make a privacy-related complaint
Ask questions regarding this privacy policy.

Should you wish todo so, please contact us at:

Wallis Payne & Co

Level 45, 55 Collins Street
Melbourne, VIC 3000

1300 070 920
info@wallispayne.com.au