Privacy Policy

Privacy Policy

Pauline Tarrant Consulting

Last updated: September 2026

1. Who we are and what this policy covers

Pauline Tarrant Consulting ("we", "us", "our") provides consulting services to businesses. As part of that work we operate a hosted business management platform at https://paulinetarrant.com, which we refer to in this policy as the Platform.

This policy explains what personal information we handle, why we handle it, where it is kept and what you can do about it. It applies to:

1. our public website,
2. the Platform and any account you hold on it, and
3. the information we collect in the course of a consulting engagement.

We have written this policy in plain language on purpose. If anything in it is unclear, ask us and we will explain it.

2. The two kinds of information we hold

It helps to separate two things, because we treat them differently.

Our own records. Information we collect and hold for our own purposes — your contact details, our correspondence with you, engagement records, invoices and the like. We decide how this information is used, within the limits set out below.

Client data on the Platform. Information that you or your staff enter into the Platform in the course of running your business. This might include records about your employees and contractors, your customers, your suppliers, and your financial transactions. That data belongs to you. We hold it so we can run the Platform for you, and we use it only to operate the Platform, support you, and do the work you have engaged us to do. We do not mine it, sell it, share it with other clients, or use it to build products.

3. What we collect

Information you give us directly. Your name, business name, email address, phone number, postal address, and any information contained in emails, documents or files you send us. If you hold an account on the Platform, we also hold your username and the settings attached to your account. We store passwords only as a cryptographic hash — we cannot read your password.

Information you enter about other people. The Platform is designed to hold business records, so the data you enter will often be about someone other than you: employees, contractors, customers, referees, and so on. Depending on how you use it, that can include names and contact details, employment and engagement records, licences, tickets, insurances, qualifications and compliance status, and payment details.

Information collected automatically. When you use the Platform or visit our website, our servers record standard technical information: IP address, browser type, pages requested, timestamps, and errors. The Platform also keeps an audit trail of changes made to records, including who made each change and when, which is a normal feature of business record-keeping and is there for your benefit.

We do not use advertising trackers or third-party analytics that profile you across other websites.

4. Why we use it

We use personal information to:

1. set up and administer your account and confirm who you are,
2. run, maintain, back up and secure the Platform,
3. provide the consulting, advisory and support services you have engaged us for,
4. respond when you contact us,
5. bill you and keep proper financial records,
6. tell you about changes to the Platform that affect you, including maintenance, outages and security matters, and
7. meet our obligations under Australian law.

We will not use your information for a materially different purpose without telling you first.

5. When you enter someone else's information

If you put another person's details into the Platform, you are responsible for having the right to do so. Practically, that means making sure the person knows their information is being recorded, roughly what it will be used for, who can see it, and that they can ask to see and correct it.

If one of those people contacts us directly, we will generally refer them to you, since you hold the relationship and control the record. Where you ask us to help with an access or correction request, we will.

6. Where your information is kept

Personal information held in the Platform is stored on servers located in Australia. We keep backup copies, also held in Australia, so that the Platform can be restored if hardware fails.

Where we use a hosting or infrastructure provider, that provider supplies storage and connectivity only. It is not permitted to access, use or disclose the information it holds on our behalf, other than as needed to keep the service running.

Some of the ordinary business tools we use to communicate with you — email, for example — may route or store messages outside Australia. If we ever move the Platform itself or its backups offshore, we will update this policy and tell affected clients before we do it.

7. How we protect it

We take reasonable steps to protect personal information from loss, misuse and unauthorised access. In practical terms:

1. all traffic to the Platform is encrypted in transit using TLS,
2. access to the Platform requires an individual account, and permissions are set so people see only the records their role requires,
3. administrative access to the underlying servers is restricted to authorised personnel,
4. the Platform and its underlying software are kept patched, and
5. backups are taken on a regular schedule and tested.

No system connected to the internet is perfectly secure, and we cannot promise that information will never be compromised. Sending information over the internet carries some risk, and you should take sensible precautions of your own — in particular, keeping your password private, using a unique password, and telling us immediately if you think your account has been accessed by someone else.

8. If something goes wrong

If we become aware of a data breach affecting your information, we will tell you promptly, explain what happened and what information was involved, and tell you what we are doing about it and what you should do.

Where a breach is likely to result in serious harm to an individual, we will also notify the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme.

9. Who else sees your information

We do not sell personal information, and we do not disclose it for anyone else's marketing.

We may disclose it:

1. to our hosting and infrastructure providers, to the limited extent described in section 6,
2. to professional advisers such as our accountant or lawyer, where genuinely necessary,
3. to a third-party service you have asked us to connect the Platform to,
4. where you have asked or agreed that we do so, and
5. where the law requires it — for example, in response to a court order, subpoena, or a lawful request from a regulator or tax authority.

If we are legally compelled to disclose your information, we will tell you unless we are prohibited from doing so.

If our business is ever sold or transferred, client records may transfer with it. We would tell you before that happened.

10. Integrations with other systems

The Platform can exchange data with other applications — accounting systems, payroll, email, file storage, and similar. Once information leaves the Platform for a third-party service at your direction, that service's own privacy practices apply, not ours. We have no control over how it is handled there. Please check the privacy policy of any service you connect.

11. Payments

We do not store credit card or bank account numbers. Payments are processed by Bank Australia, which handles and stores those details under its own security arrangements. We receive only enough information to identify the payment — for example, that an invoice has been paid and the date it cleared. Their privacy notice governs what they do with your payment details.

12. Cookies

The Platform sets a session cookie to keep you signed in and to protect your session against tampering. Without it, you cannot log in. It may also store your interface preferences so the Platform looks the same next time you visit.

Our public website uses cookies only where needed for the site to function.

You can configure your browser to warn you about cookies or block them, but blocking them will prevent you from using the Platform.

13. How long we keep things

We keep information in the Platform for as long as you hold an account with us.

When an engagement ends, we will work with you on what happens to your data — export, transfer, or deletion. We will not delete your data without your instruction, and we will not hold it hostage.

Some records we must keep for a fixed period regardless: financial records for seven years under tax law, and any records we are required to retain under corporations, employment or anti-money-laundering legislation. We keep those for the required period and no longer.

Our backups roll over on a schedule, so deleted data may persist in a backup for a short period before being overwritten.

14. Seeing and correcting your information

You can ask us what personal information we hold about you, ask for a copy, and ask us to correct anything that is wrong or out of date. Email [email protected] with your request.

We will acknowledge within 10 business days and respond in full within 30 days. There is no charge for a straightforward request.

If you hold an account on the Platform, much of your own information is visible and editable directly in the interface, which is usually faster than asking us.

Occasionally we may not be able to give you everything you ask for — most often where doing so would reveal information about someone else, or where we are required by law to withhold it. If that happens we will tell you which part of the request we could not meet and why.

15. Emails from us

We send emails about your account, billing, support, outages and security. These are part of the service and you cannot opt out of them while you hold an account.

Anything else — occasional updates about our services — is optional and every message will include a way to unsubscribe. Tell us and we will take you off the list.

16. Complaints

If you think we have mishandled your personal information, tell us. Send the details, with any supporting documents, to:

1. [email protected], or
2. Privacy Officer, Pauline Tarrant Consulting, Suite 19, 50 St Georges Tce Perth Western Australia AU 6000.

We will acknowledge your complaint within 10 business days and aim to resolve it within 30 business days. If we need longer, we will tell you why and give you a timeframe.

If you are not satisfied with how we handle it, you can take the matter to the Office of the Australian Information Commissioner — www.oaic.gov.au, 1300 363 992.

17. Changes to this policy

We may update this policy from time to time. The current version is always the one published at https://paulinetarrant.com, and the date at the top tells you when it last changed.

If a change materially affects how we handle your information, we will tell you by email or through the Platform before it takes effect. Continuing to use the Platform after that means you accept the updated policy.