Privacy Policy

Last updated: 30 September 2026

MBR AXIS Pty Ltd (ACN 661 895 487) (we, us or our), understands that protecting your personal information is important. This Privacy Policy sets out our commitment to protecting the privacy of personal information provided to us, or collected by us, when interacting with you.

We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). The APPs govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information. A copy of the Australian Privacy Principles may be obtained from the website of The Office of the Australian Information Commissioner.

The Australian Privacy Principles apply to personal information, that is, information or an opinion (whether true or not) relating to an identified individual or which can be used to reasonably identify that individual. Please note that information about companies is not personal information. However, the principles will apply to an individual who is carrying on a business as a sole trader.

What is Personal Information and why do we collect it?

Personal Information is information or an opinion that identifies an individual. Examples of Personal Information we collect include: names, addresses, date of birth, email addresses, phone number and Tax File Numbers. This Personal Information is obtained in many ways including interviews, correspondence, transactions, appointments, via our website, by email, media, publications, publicly available sources, and from third parties.

We may collect and hold personal information in both hard copy and electronic formats. We engage third parties to host electronic information through third party data servers.  

Third-party service providers are subject to their own privacy practices and contractual arrangements. We take reasonable steps in selecting and reviewing material providers, but their handling of personal information may also be governed by their own privacy policies and terms. We collect your Personal Information for the primary purpose of providing our services to you and providing information to our clients. We may also use your Personal Information for secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use or disclosure. When we collect Personal Information we will, where appropriate and where possible, explain to you why we are collecting the information and how we plan to use it.

‍Extent of information collected 
‍We do not collect any personal information other than information reasonably necessary for, or directly relating to, the primary purpose for which we have been engaged or may be engaged, or for other functions and activities. 

Collection of extraneous or excessive information will be destroyed and/or deleted as soon as it is reasonably practicable to do so.  

When you provide us with someone else’s personal information, you should only do so with their authority or consent, or if you are required or authorised by law. You should also refer them to this Privacy Policy.

How we collect your Personal Information

We collect personal information in a variety of ways, including:

  • Directly from you (e.g. via interviews, correspondence, forms, website, email, phone or in person)

  • From publicly available sources

  • From third parties (e.g. your representatives, government agencies, or other service providers)

  • From our website and digital platforms (including cookies and analytics tools)

Why we collect, hold, use and disclose Personal Information

We collect, hold, use and disclose your personal information for purposes including:

  • Providing accounting, tax and related services to you

  • Managing our business operations and internal processes

  • communicating with you and responding to your enquiries

  • Complying with our legal and regulatory obligations

  • Sending you marketing communications about our services

  • Managing complaints and disputes

We may at times use and disclose personal information about an individual for the “primary purpose” of collection (i.e. the dominant or fundamental purpose for which that information is collected).

In certain circumstances, the law may permit or require us to use or disclose personal information for other purposes (for instance where a client would reasonably expect us to and the purpose is related to the purpose of collection).

For tax clients, tax file numbers:

• can be collected by tax agents and accountants;

• can be used only to conduct client’s affairs; and

• can be disclosed only to client and the Australian Tax Office.

We collect Tax File Numbers (TFNs) in accordance with our obligation as a registered tax agent. The collection, storage, use and disclosure of TFNs are governed by the Privacy (Tax File Number) Rule 2015 and the Taxation Administration Act 1953. We will not use or disclose your TFN for any purpose other than as required or authorised by law.

Direct Marketing

We may use your personal information to send you information about our services that may be of interest to you. You may opt out of receiving marketing communication at any time by contacting us using the contact us details on this website. We do not sell or rent personal information to third parties for marketing purposes.

Sensitive Information

Sensitive information is defined in the Privacy Act to include information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Sensitive information will be used by us only:

• For the primary purpose for which it was obtained

• For a secondary purpose that is directly related to the primary purpose

• With your consent; or where required or authorised by law.

‍Sensitive information is a subset of personal information that is given a higher level of protection under the Australian Privacy Principles. Our policy is that we attempt not to collect sensitive information about our clients or prospective clients, however that may not always be possible. If any of our clients or prospective clients elect to provide us with any sensitive personal information, we will take all reasonable steps to ensure that the sensitive information is securely protected. In the event we propose to use such personal information, we will first notify you and seek your consent prior to such use. 

Third Parties

Where reasonable and practicable to do so, we will collect your Personal Information only from you. However, in some circumstances we may be provided with information by third parties. In such a case we will take reasonable steps to ensure that you are made aware of the information provided to us by the third party.

We may engage third-party service providers, contractors and professional advisers to assist in delivering our services. Such providers may have access to personal information where reasonably necessary to perform services on our behalf.

We may utilise outsourced cloud computing service providers and technology platforms and automation tools to assist in providing our services. We take reasonable steps to ensure that the use of such systems is consistent with applicable privacy laws and our professional confidentiality obligations.

Disclosure of Personal Information

Your Personal Information may be disclosed in a number of circumstances including the following:

• Third parties where you consent to the use or disclosure;

• Where required or authorised by law; and

• As part of our business.

This means that we may disclose personal information to:

  • Our employees, contractors and/or related entities.

  • IT service providers, data storage, web-hosting and server providers.

  • Professional advisers, bankers, auditors, our insurers and insurance brokers.

  • Payment systems operators or processors.

  • Our existing potential agents or business partners.

  • Courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings.

Know Your Customer

Where applicable to the services we provide, we may be required to collect, verify and maintain your personal information and information about any beneficial owners, controllers or related parties to comply with our obligations under applicable anti-money laundering, counter-terrorism financing and proliferation financing laws, including the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), associated rules and  the “Customer Due Diligence” requirements of the anti-money laundering laws and counter-terrorism regimes.

Overseas Disclosure

MBR AXIS principally operates and maintains its practice in Australia. However, we use cloud-based technology and service providers whose systems, related entities, personnel or subprocessors may store, process or access personal information outside Australia. Accordingly, personal information may be disclosed to or accessed from overseas jurisdictions, including the United States and other jurisdictions identified in our current Technology Providers & Data Locations list below. We undertake reasonable due diligence in selecting and reviewing technology providers and take reasonable steps to protect personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and our professional confidentiality obligations.

Technology Providers & Overseas Processing

We use approved cloud-based software, technology and service providers in operating our practice and providing services to clients. Some providers, or their related entities or subprocessors, may store, process or access personal information outside Australia. A current list of our material approved technology providers, their principal functions and relevant data-processing or storage locations is maintained by MBR AXIS and is available below [Noting: provider arrangements and data-processing locations may change from time to time. We periodically review this list and update it where there are material changes]:

  • Xero / Xero Practice Manager - Xero data may be hosted or processed outside Australia [Amazon Web Services – USA].

  • Syft Analytics - Syft uses third-party cloud infrastructure and service providers, including Amazon Web Services and Google Cloud Platform, together with Xero and Syft group entities and other subprocessors. Client information entered into or accessed through Syft may be hosted, stored, accessed or processed outside Australia, including in the United States, South Africa and other jurisdictions in which those providers or group entities operate [Google Cloud infrastructure – Central United States – Iowa].

  • Microsoft 365 / SharePoint / Teams - For Australian Microsoft 365 tenants, relevant data is generally hosted within Microsoft’s Australian geography, subject to Microsoft’s applicable service arrangements and subprocessors.

  • Annature - Data stored by AWS in the ap-southeast-2 Sydney region.

  • Calendly - User and invitee data stored in US-based data centers managed by Google Cloud Services (GCS) and Amazon Web Services (AWS), as our calendar booking appointment tool.

  • Approved AI Provider(s) - Information entered into these services may be disclosed to, stored, accessed or processed by the provider and its subprocessors in Australia or overseas including the United States and other jurisdictions in which they operate. We may use approved artificial intelligence, automation and other technology-assisted tools to support the provision of our services and the operation of our practice, including for research, analysis, drafting, summarisation, workflow assistance and quality-control purposes. Where client information is processed using an external AI or technology provider, we treat that provider as a third-party service provider and apply appropriate confidentiality, privacy, security and professional controls. We do not rely on artificial intelligence as a substitute for professional judgement. Material outputs used in the provision of professional services are subject to appropriate review and verification by MBR AXIS.

Security of Personal Information

Your Personal Information is stored in a manner that reasonably protects it from misuse and loss and from unauthorized access, modification or disclosure. While we are committed to security, we cannot guarantee the security of any information that is transmitted to or by us over the Internet. The transmission and exchange of information is carried out at your own risk.

When your Personal Information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify your Personal Information.

We are committed to ensuring that the personal information we collect is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure. 

We cannot guarantee the security of any information that is transmitted to or by us over the Internet. The transmission and exchange of information is carried out at your own risk. Although we take measures to safeguard against unauthorised disclosures of information, we cannot assure you that the personal information we collect will not be disclosed in a manner that is inconsistent with this Privacy Policy. 

Access to your Personal Information

You may access the Personal Information we hold about you and to update and/or correct it, subject to certain exceptions. If you wish to access your Personal Information, please contact us in writing. MBR AXIS Pty Ltd will not charge any fee for your access request. In order to protect your Personal Information we may require identification from you before releasing the requested information. Maintaining the Quality of your Personal Information It is important to us that your Personal Information is up to date.

We will take reasonable steps to make sure that your Personal Information is accurate, complete and up-to-date. If you find that the information we have is not up to date or is inaccurate, please advise us as soon as practicable so we can update our records and ensure we can continue to provide quality services to you.

Notifiable Data Breaches

In the event of a data breach, we are committed to complying with the Notifiable Data Breaches (NDB) scheme under the Privacy Act. We will take all reasonable steps to contain the breach and assess whether it is likely to result in serious harm to any individuals. If an eligible data breach occurs, we will notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable.

Policy Updates

This Policy may change from time to time and is available on our website.

Privacy Policy Complaints and Enquiries

If you have any queries or complaints about our Privacy Policy please contact us and provide us with the full details of the complaint. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take in response to your complaint. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner