Privacy Policy

This Privacy Policy explains how Max and Om Pty Ltd (ABN 71 680 893 850), trading as Max and Om Group (we, us or our), handles personal information. It covers our website at maxandom.com and the services we provide to our clients. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Who this policy covers

This policy applies to people who visit our website, contact us, subscribe to our newsletter, or work with us as clients, suppliers or prospective clients.

As a digital agency, we also build and host websites, email and software for our clients, and some of those systems collect personal information from the client's own customers. For that information we act on our client's behalf: see Information we handle for our clients below.

What personal information we collect

• Contact details: your name, email address, phone number and the business you work for, when you fill in our contact form, subscribe to our newsletter, or email or call us.
• Enquiry and project information: what you tell us about your business and project, and our correspondence with you.
• Client account and billing information: if you become a client, the details needed to provide and invoice our services, such as billing contacts and payment records. Card and bank details are handled by our payment providers, not stored by us.
• Technical information: when you visit our website, our hosting provider automatically processes technical data such as your IP address, browser type and the pages requested, to deliver the site and protect it from abuse.

Our website does not use analytics, advertising or tracking cookies. Our hosting provider may set a strictly necessary security cookie to protect the site from automated attacks. We do not ask for sensitive information. Please do not send us sensitive information (such as health information) through our forms. If we ever need sensitive information to provide a service, we will only collect it with your consent.

How we collect it

We collect personal information directly from you: through our website forms, by email, by phone, in meetings, and while we work together. Website form submissions are sent to our own form-handling service, which stores them securely and emails them to our team. Occasionally we receive your details from someone else, for example a colleague who refers you to us. Where that happens, we will take reasonable steps to let you know.

Why we collect it and how we use it

• to respond to your enquiry and prepare proposals;
• to provide, support and invoice our services;
• to send our newsletter, if you subscribed;
• to keep our website and systems secure and working; and
• to meet our legal, tax and record-keeping obligations.

We do not sell personal information. We do not use it to make automated decisions that significantly affect you.

Marketing

We only send marketing emails, such as our newsletter, to people who have subscribed or to existing clients who would reasonably expect to hear from us. Every marketing email includes a way to unsubscribe, and you can also ask us to stop at any time using the contact details below. Contacting us through our contact form does not sign you up to our newsletter.

Who we share it with

We only share personal information with service providers who help us run our business, and only as needed for the purposes above. These include:

• Cloudflare, which hosts our website and our form-handling service, stores form submissions, and runs Cloudflare Turnstile, a check on our forms that tells people from automated spam using technical signals from your browser;
• Amazon Web Services, which sends the notification emails generated by our forms; and
• our email, accounting and payment providers.

We may also disclose information where the law requires or authorises it.

Overseas storage and disclosure

Some of our providers operate infrastructure outside Australia. Cloudflare runs a global network, so your information may be processed in other countries, including the United States. Our form notification emails are sent from Amazon's Sydney region. Before using a provider that may handle personal information overseas, we take reasonable steps to make sure it protects that information in a way consistent with the Australian Privacy Principles, for example through its contractual and security commitments.

Information we handle for our clients

When we build, host or maintain a website, email system or software for a client, we may store or process personal information that belongs to that client, such as enquiries submitted through forms on the client's website. We handle that information on the client's behalf and in line with our agreement with them. The client's own privacy policy explains how they use it. If you want to access or correct information you gave to one of our clients, please contact that business first; we will help them respond.

How we keep it secure and how long we keep it

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Our systems use encrypted connections, access is limited to people who need it, and we rely on providers with strong security practices.

We keep personal information only for as long as we need it. Enquiries that do not lead to work are deleted or de-identified when no longer needed. Client and financial records are generally kept for 7 years to meet our record-keeping obligations, then securely destroyed or de-identified.

If we experience a data breach that is likely to result in serious harm, we will assess it promptly and notify the people affected and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.

Accessing and correcting your information

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. Contact us using the details below. We may need to verify your identity, and we will respond within 30 days. If we refuse a request, we will tell you why, as the Australian Privacy Principles allow.

Complaints

If you are concerned about how we have handled your personal information, please contact us first so we can try to resolve it. We will acknowledge your complaint, look into it, and respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated.

Contact us

Max and Om Pty Ltd, Sydney, New South Wales, Australia
Email: Email us