Murcia Pestell Hillard Pty Ltd
(ACN 082 607 921)
(MPH)

 MPH Privacy Policy (Policy)

1 General

1.1  In this Policy:

  • Claim means any claim in law or equity, or under statute, for a remedy of any nature whatsoever, whether contingent, prospective, actual or otherwise and including any and all claims, actions, sums of money, arbitrations, suits, counterclaims, demands, causes of action, debts due, verdicts, judgments, Losses, account reckonings, proceedings and charges;
  • Law means any law or legal requirement, including at common law, in equity, under any statute, regulation or by-law and any decision, directive, guidance, order, decree, guideline or requirements of any authority;
  • Loss means any damage, loss, expense and cost whatsoever including any cost or expense regarding any Claim and any legal costs and expenses of any nature;
  • User, you or your means any person who accesses and uses a Website; and
  • Websites means https://www.mphlawyers.com.au/ and any other website owned or operated by MPH and Website means any one of them.

1.2  This Policy has been prepared in accordance with:

  • applicable Australian privacy and data protection laws, including the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles contained therein; and
  • the General Data Protection Regulation (EU) 2016/679 (GDPR),

as applicable.

1.3  This Policy applies to MPH’s collection and disclosure of your Personal Information (as defined in clause 3) when you use the Websites or otherwise interact with MPH.

1.4  This Policy is intended to describe what information MPH collects and/or processes; how MPH uses it; and under what circumstances, if any, MPH discloses any Personal Information. Please read this Policy before using the Websites or before submitting any Personal Information to MPH. By using the Websites, interacting with MPH or submitting any Personal Information to MPH, you are accepting the practices described in this Policy.

1.5  MPH may in its absolute discretion elect to amend or replace this Policy by uploading a revised version of the Policy on the Websites from time to time. A copy of the most up to date version of this Policy will be made available to view at www.mphlawyers.com.au/privacy-policy. Any changes made to this Policy will apply immediately from the date MPH uploads the revised Policy to www.mphlawyers.com.au/privacy-policy. In addition, MPH may, but is not obliged to, notify you by email of any updates to this Policy. MPH strongly encourages you to refer to this Policy on an ongoing basis to understand your rights under the Policy. Unless otherwise stated, the most current Policy will apply to all information MPH has about you. If you do not agree with the practices outlined in this Policy, you must immediately stop accessing the Websites or interacting with MPH.

1.6  In this Policy, the word “including” and similar expressions are not, nor are they to be interpreted as, words of limitation.

2  Types of Information Collected

2.1  The types of information MPH may collect includes:

Personal Information, which includes information which identifies a natural person, or by which the person’s identity may be reasonably determined. It may include a person’s full name, mailing or residential address, date of birth, bank account details, signature, credit card details, phone number and email address, as well as well as “personal data” (for the purposes of the GDPR) or Sensitive Information. For the purpose of this Policy, the term “Personal Information” also includes:

  • information we collect through your interactions with MPH or other interactions with content on the Websites (including information you provide through completing any forms on a Website); and
  • personal information obtained from a third party which, under and in accordance with the Privacy Act, may lawfully be exchanged.

Sensitive Information, which includes information (or an opinion) about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices or criminal record, as well as information about an individual’s health, genetic information or biometric information.

Statistical Information, which includes the internet protocol (IP) address of your device used to connect to the Websites created by MPH, time zone setting, language preferences, location data, information about your browser, phone, hardware and software (including your hardware model, operating system version, device memory, advertising or unique application or device identifiers and (potentially) information about your applications installed, battery level, as well as other information which does not identify you personally, but which tracks your usage of the Websites or interaction with MPH.

2.2  MPH may collect your Personal Information where:

  • you enquire about or instruct us to provide legal services to you, your employer, organisation or other representative;
  • you are a director or ultimate beneficial owner of a prospective or existing client or client’s group;
  • we have other legal or business dealings with you or an organisation related to you;
  • MPH is required by Law to do so;
  • you are an employee, partner, contractor or officeholder of MPH;
  • you visit our website;
  • you register for or attend one of our events, seminars or webinars; or
  • you enquire about or apply for a role at MPH, participate in work experience or otherwise temporarily work at MPH.

2.3  MPH also collects information automatically (through the use of cookies) on the Websites, as discussed in this Policy further below.

3  How MPH collects Personal Information

3.1  MPH generally collects your information directly from you. In some instances, MPH may collect your information from third parties, such as:

  • your employer or contracting agency, your business contacts or other organisations that you deal with, regulatory or credit report agencies, a supplier or from a publicly available record;
  • where you apply for a role with MPH, from recruitment consultants, your previous employers, universities, and others who may be able to assist us in our decision as to whether to offer you employment; and/or
  • in circumstances where you are a current or potential client (or you work for or are connected with a client), from third party IT and other service providers who MPH engaged to provide verification, screening and/or onboarding services as required by anti-money laundering, counter-terrorism/financing and/or other applicable Laws upon your use of those services.

3.2  MPH collects Personal Information when you:

(a)  interact with content on the Websites (including through completing any forms on a Website); and/or

(b)  provide MPH with feedback, make an enquiry or request of MPH or make a complaint.

3.3  In the event MPH receives unsolicited Personal Information about you (ie where MPH has taken no active steps to collect the Personal Information), it will only be collected where:

  • such collection is reasonably necessary for, or directly related to, one or more of MPH’s functions or activities; and
  • MPH either:
    • obtains your consent; or
    • is authorised or required to do so by Law.

3.4  Where MPH receives unsolicited Personal Information and clause 3 does not apply to that Personal Information, MPH will (as soon as practicable) destroy or de-identify the unsolicited Personal Information that MPH receives.

3.5  Where clause 3 applies to any unsolicited Personal Information that MPH has received, MPH will treat the Personal Information in accordance with the Privacy Act and this Policy.

4  How MPH uses Personal Information

4.1  MPH will use your information to:

  • facilitate MPH’s compliance with Laws (including requirements under the Anti-Money Laundering and Counter-Terrorism Financing Act (Cth) (AML/CTF Act));
  • verify your identity;
  • provide services to you, your organisation and our clients and to improve them;
  • to identify and develop new services you, your organisation and our clients may be interested in;
  • conduct, monitor and analyse our business and internal operations;
  • communicate with you and build and maintain our relationship with you, your organisation and our clients;
  • send you legal updates and insights, marketing and event details and new service offerings (however, if you do not want to receive marketing emails from us, you can opt out at any time by replying to the relevant email with the word “STOP” in the subject or body of the email);
  • perform analytics on matter management, financial performance and engagement at our events and with our online resources;
  • comply with all Laws (including providing information to regulatory bodies in relation to your attendance at our CPD programs or in relation to any compliance audit of your CPD attendance);
  • comply with court orders and to protect, exercise or defend our legal rights;
  • provide you with work experience opportunities, discuss potential roles with you, consider your application and test and assess your suitability for roles; and
  • process and respond to your requests, enquiries or complaints.

4.2  MPH is a ‘reporting entity’ under the AML/CTF Act. The AML/CTF Act requires us to collect information, which may include government issued identifiers, about our clients that are individuals and certain individuals that are connected with our clients. Information collected for AML/CTF purposes is held separate from our operational data and is used to ensure compliance with MPH’s obligations under the AML/CTF Act.

4.3  As legal practitioners, MPH is also bound to our clients by professional obligations of confidentiality and legal professional privilege. MPH will, at all times, continue to treat and protect all client information it receives (including any personal information) in accordance with those obligations.

4.4  may from time to time use artificial intelligence tools (being tools that utilise generative artificial intelligence, large language models, machine learning or similar technologies to process, analyse or generate content (AI Tools)) as part of our practice, including (without limitation) to support legal research, document review, due diligence, data analysis, automation, translation, transcription and risk assessments. MPH maintains internal policies and guidelines and provides its team with ongoing training to ensure responsible use and compliance with relevant ethical rules and data protection Laws. Where such tools are used in the delivery of services to you, appropriately qualified and experienced members of our fee-earning teams review outputs to confirm accuracy and completeness.

5  Disclosure of Personal Information

5.1  By accessing a Website or interacting with MPH, you consent to the disclosure of your Personal Information in accordance with this Policy.

5.2  MPH may disclose your information to:

  • our clients, where we have collected your personal information for the purposes of providing services to our clients;
  • barristers, legal consultants and other specialists in relation to your matter;
  • our suppliers, contractors, employees and agents from time to time that provide services to us or help us to provide and market our services to you;
  • specific third parties authorised by you to receive information held by us; and
  • such other persons, including government agencies, regulatory bodies, law enforcement agencies and courts and as otherwise required or authorised by law.

5.3  Unless otherwise specified in this Policy or as required by Law, you authorise MPH to disclose your Personal Information and Statistical Information to third parties:

  • where MPH assigns, transfers, sells or otherwise licenses its rights under this Policy to a third party. Where this occurs, MPH will (if possible) take reasonable steps to notify you using the Personal Information you have provided;
  • where MPH reasonably believes (acting in good faith) that such disclosure is necessary in order to investigate, prevent or take action regarding illegal activities (including suspected fraud), situations involving potential threats to the physical safety of any person, violations of this Policy or any of MPH’s other terms of service, or as otherwise required by Law;
  • in a business transaction, including a merger with or acquisition by another company or the sale of all or a substantial portion of MPH’s assets, of which your Personal Information and Statistical Information may be among the assets transferred. Where this occurs, MPH will (if possible) take reasonable steps to notify you using the Personal Information you have provided; and
  • where such disclosure is required by Law, or where MPH reasonably believes in good faith that such disclosure is necessary to protect MPH’s rights.

5.4  You consent to MPH disclosing Statistical Information to third parties, including to analytics companies and MPH’s business partners, to help MPH understand usage patterns, to assist in Websites and product development and for advertising purposes (subject to what is permitted by Law).

5.5  MPH may from time to time disclose your Personal Information to overseas entities who may not be bound by Australian Law. Where MPH discloses your Personal Information to overseas recipients, MPH will make every reasonable effort in the circumstances to ensure that the overseas recipients comply with this Policy and any applicable Australian Law concerning the protection of Personal Information, unless:

  • MPH reasonably believes that the overseas recipient is bound by Laws that are substantially similar to the Privacy Act which can be enforced against the overseas recipient; or
  • you give MPH an informed consent to the disclosure of your Personal Information to an overseas recipient who may not be bound by Australian Law; or
  • the disclosure to an overseas recipient is authorised or required by Australian Law (including the Privacy Act).

5.6  Under the AML/CTF Act MPH may be required to disclose your information to the Australian Transaction Reports and Analysis Centre (AUSTRAC), a government financial intelligence unit. Certain disclosures required by law may be made without prior notification to you.

6  How MPH Uses Cookies

6.1  If you continue to access the Websites, you agree to MPH’s use of tracking technologies, referred to as cookies, to track and record your usage. Cookies are text files placed on your computer or compatible device to collect standard internet log information and visitor behaviour information.

6.2  When you access or use the Websites, MPH will automatically use cookies to collect technical information including:

  • Statistical Information; and
  • information about your interaction with the Websites, activity on third party websites which are linked to the Websites, and views and interactions with content on the Websites.

6.3  You may control the technical information MPH collects, including through your browser or device settings. In doing so, you:

  • acknowledge some of MPH’s services may not function properly if you choose to disable cookies; and
  • release MPH and any of its related bodies corporate (as defined by the Corporations Act 2001 (Cth)) and their directors, officers, employees and agents from any and all Claims, liability and Losses which may arise out of, result from, or relate in any way to your decision to disable cookies (including any limitation on your ability to use the Websites or services provided by MPH).

7  GDPR

7.1  MPH will, to the extent required, comply with the principles of data protection (including as set out in the GDPR) for the purpose of fairness, transparency and lawful data collection and use.

7.2  Where the GDPR applies, MPH will process Personal Information as a processor and/or, to the extent relevant, as a controller (as those terms are defined in the GDPR).

7.3  Where the GDPR applies, MPH must have a legal basis to process Personal Information which it collects. MPH relies on several legal bases to process Personal Information in accordance with this Policy, including:

  • where the person has consented to the processing of Personal Information by MPH (which consent may be withdrawn at any time);
  • for MPH’s legitimate interests to operate, provide or improve any Website or its products and services;
  • where necessary to provide access to, and use of, any Website; and/or
  • where MPH is authorised or required by Law to do so.

7.4  MPH will only process any Personal Information that is considered Sensitive Information if the person expressly consents to it being provided to MPH or if MPH is permitted or required to by Law.

7.5  Where a person has (directly or indirectly) provided consent to MPH processing their Personal Information, the consent may be withdrawn at any time with future effect – i.e. the withdrawal of consent does not affect the lawfulness of processing based on the consent before its withdrawal. If consent is withdrawn, MPH will only continue processing the person’s Personal Information where MPH is permitted or obliged to do so by Law (including under the GDPR).

8  Your Rights Under this Policy

8.1  This clause 8 sets out the rights you have in relation to how your Personal Information is obtained and used.

8.2  Except as otherwise provided by Law, you have the following rights in connection with your Personal Information we have collected in accordance with the Australian Privacy Principles (APP):

  • the right to be informed how your Personal Information is being used;
  • the right to access your Personal Information (and MPH will provide you with a free copy of it);
  • the right to correct your Personal Information if it is inaccurate or incomplete;
  • a right to opt out of receiving direct marketing communications, where applicable; and
  • a right to complain to us, and then to the Office of the Australian Information Commissioner, if you believe your Personal Information has been mishandled.

8.3  You are encouraged to contact MPH at any time if you wish to exercise your rights in relation to this Policy. MPH reserves the right to request you verify your identity before MPH acts on any request made by you.

9  Storage of Personal Information

9.1  MPH implements a variety of security measures to maintain the safety of your Personal Information. Your Personal Information is held on our company servers located in Australia (or otherwise as determined by MPH from time to time) in a controlled, secure environment where it is protected from unauthorised access, use or disclosure.

9.2  MPH’s servers may at times be located overseas in countries which are not bound by the Privacy Act, and you hereby expressly consent to the disclosure of your Personal Information to overseas recipients. In doing so, you agree that MPH is not obliged to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information.

9.3  Some of MPH’s service providers are located outside of Australia. As a result, Personal Information collected and held by MPH may be transferred to recipients in other countries. In particular, where MPH engages a third party to provide it with services in connection with the operation of MPH’s business and the delivery of the Services, MPH may transfer or process your Personal Information to those third parties in foreign jurisdictions.

10  Security of Personal Information

10.1  MPH will use all reasonable efforts to keep secure your Personal Information, Statistical Information and all other information that you transmit to MPH through your use of Websites, your interaction with MPH or otherwise. MPH will take all reasonable care to protect and prevent unauthorised access to, or modification and disclosure of, your Personal Information.

10.2  Notwithstanding clause 1 above, you acknowledge the internet is inherently insecure and no data transmission online can be guaranteed as fully secure. Accordingly, MPH cannot guarantee or warrant the security of any information (including Personal Information) you provide through your use of the Websites. You understand that any Personal Information you provide to us directly or indirectly is done so at your own risk.

10.3  If MPH becomes aware of a breach of security in relation to your Personal Information, MPH will use all reasonable endeavours to take action to promptly remedy the security breach, in order to limit the risk caused by unauthorised access to, or unauthorised disclosure of, your Personal Information.

10.4  If MPH becomes aware of a breach of security, and a third party has, without authorisation:

  • accessed your Personal Information; or
  • disclosed your Personal Information to another third party,(Data Breach),and a reasonable person would conclude that such unauthorised access or disclosure is likely to result in serious harm to you, then MPH will (as required by Law) notify you and the Office of the Australian Information Commissioner (OAIC) with details of the Data Breach, including details of how MPH believes the Data Breach has occurred and to what Personal Information such Data Breach relates, and the steps that you can take in response to the Data Breach.

10.5  If MPH becomes aware of a Data Breach which results in any of your Personal Information being lost and MPH has reasonable grounds to believe that:

  • unauthorised access to, or unauthorised disclosure of, your Personal Information is likely to occur; and
  • if unauthorised access to, or unauthorised disclosure of, your Personal Information occurs, a reasonable person would conclude that such unauthorised access or disclosure is likely to result in serious harm to you,then MPH will notify you and the OAIC with the details of the Data Breach, including details of how MPH believes the Data Breach has occurred and to what Personal Information such Data Breach relates, and the steps that you can take in response to the Data Breach.

10.6  You acknowledge and understand that if you access the Websites from outside Australia, other entities including, potentially, foreign governments, may collect, use and disclose your Personal Information in ways which differ from this Policy and the Laws of Australia, and that MPH will in such circumstances have no control over such collection of your Personal Information (and are not liable to you for any Loss in any way in relation to such collection).

11  How long your Personal Information is stored

11.1  You consent to MPH retaining your Personal Information for as long as necessary to fulfil the purposes for which MPH has collected it, including in order to satisfy any Law.

11.2  To determine the appropriate retention period for Personal Information, MPH will consider the amount, nature and sensitivity of the Personal Information collected from you, the potential risk of unauthorised use or disclosure of your Personal Information, the purposes for which MPH processes the Personal Information and whether MPH can achieve those purposes through other means. MPH will also at all times have regard to the applicable legal requirements under the Privacy Act (as applicable).

12  Third parties

12.1  Where MPH provides your Personal Information to third parties in accordance with this Policy, including through the use of AI Tools, you acknowledge and agree that:

  • MPH ensures appropriate contractual and technical safeguards are in place to protect the confidentiality and security of that information, however, the use of your Personal Information by third parties is not in MPH’s reasonable control;
  • your Personal Information may be transferred and/or processed through servers in a foreign jurisdiction;
  • third party websites may place their own cookies or other files on your computer or compatible device, solicit Personal Information from you and may or may not use your Personal Information in accordance with their own privacy policies which may differ from this Policy; and
  • it is your responsibility to familiarise yourself with the privacy policy of any third party website you visit which collects Personal Information about you and to use your discretion when providing such Personal Information.

12.2  If MPH discloses Personal Information to a third party, MPH will always act to protect it in accordance with this Policy. However, you agree that MPH, its related bodies corporate (as defined by the Corporations Act 2001 (Cth)) and any of MPH or its related body corporate’s directors, officers, employees or agents will not be liable for any Loss or liability which may be incurred as a result of, or in connection with, or in relation to any use of your Personal Information by a third party to whom MPH validly disclosed the Personal Information (and you agree to make no claim against any of those parties in that regard).

13  How to Contact MPH

13.1  If you believe that the privacy of your Personal Information has been compromised or that your Personal Information has not been used in accordance with this Policy, you should contact MPH as soon as possible using the means on the Websites or at:

Email:        legal@mphlawyers.com.au

14  How to Contact the Office of the Australian Information Commissioner

If you do not receive a satisfactory response from MPH, or you believe that MPH has not handled your complaint satisfactorily, you may wish to refer your complaint to the Office of the Australian Information Commissioner at:

Address:    GPO Box 5288, Sydney NSW 2001
Email:        enquiries@oaic.gov.au
Phone:       1300 363 992