Privacy Policy
Template status: Draft v0.1 for founder review. Not approved for use. Owner: Jack Stoneman. Last updated: [DATE]. Effective: [DATE].
1. About this policy
1.1 This policy explains how Bandura Pty Ltd (ACN [PENDING]) trading as Bandura (Bandura, we, us), of Melbourne, Victoria, collects, holds, uses and discloses personal information in running our business and our website, bandura.ai.
1.2 We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Bandura may currently fall under the small business exemption in that Act (annual turnover of A$3 million or less), but we have chosen to comply with the APPs in full because our clients in the legal sector expect it and because it is the right way to handle information.
1.3 Client Data is handled separately. When we provide services to a client, we may handle personal information contained in the client's documents and systems. We handle that information on the client's instructions under our Master Services Agreement and Data Handling Schedule, and the client's own privacy policy governs it. This policy covers the personal information we collect for our own purposes.
1.4 Bandura is a consultancy, not a law practice. Nothing in this policy or on our website is legal advice.
2. What we collect
2.1 Contact and professional details: name, employer or firm, role, work email, phone number, and professional interests. We collect these when you contact us, subscribe, attend a session, or do business with us.
2.2 Communications: the content of emails, contact form messages, meeting notes and correspondence with you.
2.3 Event and training information: attendance at sessions, and any dietary or accessibility requirements you choose to give us for an event. Dietary or accessibility details may reveal sensitive information (for example health or religious belief); we collect them only with your consent, use them only for the event, and delete them afterwards.
2.4 Newsletter engagement: whether our emails were opened and which links were clicked, as reported by our email platform.
2.5 Website analytics: aggregated, non-identifying statistics about Site visits (pages viewed, country, browser type, referring site). Our analytics tool is cookieless and does not identify individuals or track you across websites.
2.6 Billing and supplier information: business contact details, ABN and bank account details needed to invoice or pay you. We do not collect payment card details.
2.7 Recruitment: if you apply to work with us, the information in your application and from referees you nominate.
2.8 We do not collect government identifiers (such as tax file numbers) except where the law requires it for contractors or employees, and we do not collect sensitive information except as described in 2.3 or with your consent.
3. How we collect it
3.1 Directly from you: through our contact form, email, phone, meetings, events and sessions, and newsletter sign-up.
3.2 From your organisation: when a client gives us the details of its people for an engagement or session.
3.3 From public professional sources: for example firm websites, court and bar directories, and professional networking sites, where we collect business contact details for a prospective client or collaborator. We only do this where it is reasonable and for the purposes in section 5.
3.4 You may deal with us anonymously or under a pseudonym where that is practicable, for example when browsing the Site or asking a general question. We need your identity to provide services, issue certificates or invoices, or respond to privacy requests.
4. Collection notice
When we collect personal information from you we aim to tell you, at or before the time, who we are, why we are collecting it and that this policy applies. Our contact form and newsletter sign-up link to this policy for that purpose.
5. Why we collect, use and disclose it
We collect, use and disclose personal information to:
- respond to enquiries and provide information you ask for;
- scope, deliver, manage and invoice our services;
- run training, workshops and events, including issuing certificates of attendance;
- send our newsletter and updates about our work, where you have subscribed or would reasonably expect it (section 6);
- manage relationships with clients, prospective clients, suppliers and collaborators;
- improve our Site, content and services, using aggregated information where possible;
- recruit;
- comply with legal obligations (for example tax and record-keeping) and protect our legal rights.
We do not sell personal information. We do not use personal information we hold for our own purposes to train AI models.
6. Direct marketing
6.1 We send our newsletter only to people who have subscribed, or who have an existing business relationship with us and would reasonably expect to receive it. Every marketing email identifies us and includes a working unsubscribe link. You can also unsubscribe by emailing jstoneman@bandura.ai.
6.2 We do not provide your details to other organisations for their marketing.
7. Who we disclose it to
7.1 We disclose personal information to service providers who help us run our business, under terms that require them to protect it:
| Provider | Purpose | Location of processing |
|---|---|---|
| Microsoft (Microsoft 365) | Email, documents, calendar, video meetings | [Australia — confirm tenant location] |
| Attio | Customer relationship management (contact details and notes) | United States |
| beehiiv | Newsletter delivery and engagement statistics | United States |
| Cloudflare | Website hosting, DNS, security and cookieless analytics | Global network; analytics are aggregated |
| DocuSign | Electronic signature of agreements | [United States / Australia — confirm] |
| Xero | Invoicing and accounting | [Confirm — Xero hosts on Amazon Web Services; region to be confirmed] |
| Amazon Web Services | Our own systems and tooling | Australia (Sydney) |
7.2 We may also disclose personal information to our professional advisers (accountants, lawyers, insurers), to a buyer or successor if our business is sold or restructured (on the same privacy terms), and where required or authorised by law, a court or a regulator.
8. Overseas disclosure
8.1 Some of the providers in section 7 store or process information outside Australia, principally in the United States (Attio, beehiiv, and where applicable DocuSign and Xero). Cloudflare operates a global network, though the analytics information we receive is aggregated and does not identify you.
8.2 Before disclosing personal information to an overseas recipient we take reasonable steps to ensure it will be handled consistently with the APPs, including by choosing reputable providers, reviewing their privacy and security terms, limiting what we share to what the purpose needs, and configuring the services to minimise data collection. Overseas recipients may be subject to different privacy laws, and we remain accountable under the Privacy Act for information we send overseas.
9. Storage and security
9.1 We hold personal information in the systems in section 7 and on Bandura devices. We protect it with encryption in transit and at rest, multi-factor authentication on all accounts, least-privilege access, full-disk encryption on devices, and regular review of who has access.
9.2 We keep personal information only as long as we need it for the purposes in section 5 or as the law requires. As a guide: enquiry records for [2] years after our last contact; client and supplier records for 7 years after the relationship ends, for tax and legal purposes; newsletter details until you unsubscribe and for [30] days after; event dietary and accessibility details until shortly after the event; recruitment information for [12] months unless you ask us to delete it sooner. When information is no longer needed we delete or de-identify it.
9.3 If we experience a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
10. Cookies and analytics
10.1 The Site uses Cloudflare Web Analytics, which is cookieless and does not collect personal information or track you across websites.
10.2 Our newsletter platform uses a small tracking image to tell us whether an email was opened and which links were clicked. You can prevent this by disabling images in your email client. Unsubscribing stops all tracking.
10.3 Embedded third-party content on the Site (for example a video player) may set its own cookies, subject to that provider's policy. [Delete if not applicable.]
11. Access and correction
11.1 You may ask for access to the personal information we hold about you, or ask us to correct it, by contacting us (section 14). We will respond within 30 days. We do not charge for requests. We may need to verify your identity first.
11.2 If we refuse access or correction, we will tell you why in writing (unless it would be unreasonable to do so), and how you can complain. If we refuse a correction request you may ask us to attach a statement to the information noting that you believe it is inaccurate.
12. Complaints
12.1 If you are concerned about how we have handled your personal information, please contact us first (section 14). We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
12.2 If you are not satisfied with our response, you may complain to the OAIC: www.oaic.gov.au | 1300 363 992 | GPO Box 5288, Sydney NSW 2001.
13. Changes to this policy
We may update this policy from time to time. The current version is always at bandura.ai/privacy, with its effective date. Material changes will be flagged on the Site or by email to subscribers.
14. Contact
Jack Stoneman, Director and privacy contact Bandura Pty Ltd Email: jstoneman@bandura.ai Post: [POSTAL ADDRESS]
Drafting notes
- Small business exemption (1.2). Bandura is likely a "small business operator" under s 6D and not automatically an APP entity. The policy says we comply by choice. Consider formally opting in under s 6EA (notice to the OAIC, listed on the opt-in register); once opted in, compliance is mandatory and enforceable. Clients may find the formal opt-in more persuasive than voluntary compliance. Note also that the Government has flagged removing the exemption; monitor.
- Automated decision-making transparency. Amendments to the Privacy Act commencing 10 December 2026 will require privacy policies to disclose certain uses of personal information in automated decisions. Bandura does not appear to make such decisions with the personal information covered by this policy; confirm, and revisit before that date.
- Overseas disclosure (8). Drafted on the "reasonable steps" basis (APP 8.1) rather than relying on consent (APP 8.2(b)), because consent must be express and informed and is fragile for newsletter sign-ups. Confirm the locations for Microsoft 365, DocuSign and Xero and update section 7.
- Collection from public sources (3.3). APP 3.6 generally requires collection from the individual unless unreasonable or impracticable. Prospecting from directories is common, but keep it proportionate and give a short collection notice at first contact (APP 5), for example a sentence in the first email linking to this policy.
- Spam Act 2003 (Cth). Section 6 reflects the consent, identification and unsubscribe requirements. "Existing business relationship" inferred consent should be used sparingly; prefer express opt-in. If phone marketing is ever used, the Do Not Call Register Act applies.
- Newsletter tracking pixels (10.2). Disclosed because beehiiv enables open and click tracking by default. Consider turning off open tracking; it is of limited value and some firms' email security tools flag it.
- Retention periods (9.2). Placeholders; align to what is actually done in Attio and Microsoft 365. Automate deletion where possible so the stated periods are true.
- Sensitive information at events (2.3). Dietary and accessibility requirements are the only likely sensitive information. Collect through a free-text field with a short consent statement, and purge after the event.
- GDPR and UK GDPR. If subscribers or attendees are in the EU or UK, those regimes could technically apply to the newsletter. Exposure is low; consider a one-line statement later if the audience grows internationally.
- Statutory tort. The new statutory tort for serious invasions of privacy (commenced June 2025) is not relevant to this policy's content but is relevant to Bandura's own practices around, for example, recording sessions. Cross-reference the Workshop Terms.
- Client Data boundary (1.3). Important for clarity with law firm clients: this policy is about Bandura's own information handling. The Data Handling Schedule does the heavy lifting for engagement data; make sure the website links to a public summary of it (a "trust" page).