Privacy Policy

Lexon Advisory Pty Ltd (ACN 666 823 338) ("Lexon", "we", "our" or "us") respects your privacy and is committed to protecting personal information.

This Privacy Policy explains how we collect, use, hold and disclose personal information when you visit our website, contact us, submit an enquiry, engage us to provide professional services, or otherwise interact with us.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We handle tax file number information in accordance with the Privacy (Tax File Number) Rule 2015. We handle identification and customer due diligence information in accordance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the rules made under it.

Where you engage Lexon to provide professional services, our engagement terms will also apply to the handling of information collected in connection with that engagement.

The personal information we collect depends on how you interact with us.

Through our website and in connection with general enquiries, we may collect:

• your name;
• email address;
• telephone number;
• business name and position;
• information you provide in an enquiry or other correspondence; and
• any other information you voluntarily provide to us.

Where you engage us to provide professional services, we may also collect:

• date of birth and residential address;
• tax file numbers, Australian Business Numbers and Australian Company Numbers;
• identification documents, including passports, drivers licences and other identity records;
• financial information, including income, assets, liabilities, bank account details and transaction records;
• details of business interests, shareholdings, trust relationships and beneficial ownership;
• superannuation information, including self managed superannuation fund records;
• information about family members, associates and related entities where relevant to structuring, succession or estate matters;
• information obtained from the Australian Taxation Office, the Australian Securities and Investments Commission and other agencies where you have authorised us to act; and
• correspondence and records relating to the engagement.

We may also collect certain technical information when you visit our website, such as:

• your IP address;
• browser and device information;
• operating system;
• pages visited and how you navigate the website;
• date and time of visits;
• referring websites; and
• information collected through cookies, analytics and similar technologies.

We generally do not seek to identify individual website visitors from this technical information.

We do not generally seek to collect sensitive information as defined in the Privacy Act.

In limited circumstances, information of a sensitive nature may be relevant to an engagement. Examples include health information relevant to a question of capacity, incapacity or succession planning.

Where we collect sensitive information, we will do so only with your consent, or where the collection is required or authorised by law, or where another exception under the Australian Privacy Principles applies.

As a registered tax agent, we collect and hold tax file numbers where this is necessary to provide taxation services, including preparing and lodging returns and dealing with the Australian Taxation Office on your behalf.

We handle tax file number information in accordance with the Privacy Act and the Privacy (Tax File Number) Rule 2015. In particular:

• you are not legally obliged to quote your tax file number, although we may be unable to provide some services if you do not;
• we use and disclose tax file number information only for purposes authorised by taxation, personal assistance or superannuation law;
• we do not use a tax file number as a general identifier for you or as a means of linking records; and
• we take reasonable steps to protect tax file number information from misuse, loss and unauthorised access, and to securely destroy or permanently de-identify it when it is no longer required by law to be retained.

Since 1 July 2026, accountants providing designated services in Australia have been regulated under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Lexon Advisory is enrolled with the Australian Transaction Reports and Analysis Centre (AUSTRAC).

Before providing certain services we are required by law to:

• verify your identity and, where applicable, the identity of beneficial owners of a company, trust or other entity;
• collect and verify information about the ownership and control structure of entities we act for;
• determine whether you or a beneficial owner is a politically exposed person;
• conduct ongoing customer due diligence throughout the engagement; and
• keep records of the information collected and the steps taken.

For these purposes we may collect identification documents and may use electronic identity verification services, which may check the information you provide against records held by government agencies, credit reporting bodies and other data sources.

If you would prefer that your identity is not verified electronically, please tell us. We will discuss alternative means of verification with you, such as providing certified copies of identity documents.

We are also required in certain circumstances to report matters to AUSTRAC, including suspicious matter reports. Where we are required to make such a report, the law prohibits us from telling you that a report has been made or from disclosing its contents.

If you do not provide the information we are required to collect, we may be unable to act for you.

We collect government related identifiers, including tax file numbers, Australian Business Numbers, Australian Company Numbers and identifiers appearing on identity documents, where this is required or authorised by law or is reasonably necessary to provide our services.

We do not adopt a government related identifier as our own identifier for you, and we use and disclose those identifiers only as permitted under the Australian Privacy Principles.

We generally collect personal information directly from you, for example when you:

• complete a contact or enquiry form on our website;
• contact us by email, telephone or in writing;
• request information about our services;
• subscribe to communications from us;
• provide documents or information in connection with an engagement; or
• otherwise voluntarily provide information to us.

Enquiries submitted through our website are delivered to us by email at info@lexonadvisory.com.au and are handled in accordance with this Privacy Policy.

We may also collect personal information from third parties where this is reasonably necessary and permitted by law, including from:

• the Australian Taxation Office and other government agencies, where you have authorised us to act;
• the Australian Securities and Investments Commission and public registers;
• electronic identity verification providers;
• your other advisers, including lawyers, financial advisers, bankers and previous accountants, where you have authorised the disclosure; and
• publicly available sources.

We may also collect information automatically through your use of our website, including through cookies and analytics technologies.

We may use personal information to:

• respond to enquiries and requests;
• provide accounting, taxation, advisory and related professional services;
• prepare and lodge returns, financial statements and other documents;
• communicate with you and with third parties on your behalf where authorised;
• verify your identity and meet our customer due diligence obligations;
• arrange an initial discussion or meeting;
• manage our relationship with you and administer our engagement, including billing;
• improve and maintain our website and understand how it is used;
• monitor website performance and security;
• send communications or marketing where permitted by law;
• protect our business, systems and users from misuse or unauthorised activity; and
• comply with our legal, regulatory and professional obligations, including those under taxation law, the Tax Agent Services Act 2009 (Cth), the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), and the professional and ethical standards of Chartered Accountants Australia and New Zealand and The Tax Institute.

We will not use personal information for purposes unrelated to those described above unless permitted or required by law, or with your consent.

We do not sell or rent personal information.

Our website uses cookies and similar technologies. Cookies are small files stored on your device that allow a website to recognise your browser and remember certain information about your visit.

We use cookies and similar technologies to:

• enable website functionality;
• maintain website security;
• understand how visitors use our website;
• measure website performance;
• identify technical issues; and
• improve the website and the experience of visitors.

We use Google Analytics to understand how our website is used. Google may collect information about your use of our website in accordance with its own privacy policy.

We do not use advertising or social media tracking pixels. If we do so in future, this Privacy Policy will be updated before those technologies are enabled.

You can generally control or disable cookies through your browser settings. Disabling cookies may affect the functionality of parts of the website.

We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy.

Depending on the circumstances, this may include disclosure to:

• the Australian Taxation Office, the Australian Securities and Investments Commission, AUSTRAC, the Tax Practitioners Board and other government agencies and regulators;
• your other advisers, including lawyers, financial advisers, bankers, auditors and insurers, where you have authorised the disclosure;
• electronic identity verification providers;
• technology, website hosting, email, analytics and information technology security providers;
• professional advisers and service providers assisting us in operating our business, including our own legal advisers and professional indemnity insurers;
• professional bodies in connection with quality review or disciplinary processes; and
• any person where required or authorised by law, including under a subpoena, notice or court order.

Where we use third party service providers, we take reasonable steps to ensure that personal information is handled appropriately and only for purposes relevant to the services they provide to us.

Some of the technology and service providers we use to operate our website, store records and communicate with you may store, process or access information outside Australia.

Our email and document storage are provided through Microsoft 365, and customer data is hosted in Australia. Microsoft may access that data from other locations, including the United States of America, for support and service purposes.

Our website hosting and website analytics services, including Google Analytics, store and process information in the United States of America.

Personal information is therefore likely to be stored or accessed in Australia and the United States of America.

We do not engage service providers located outside Australia to assist with the preparation of returns, financial statements, activity statements or other client work.

Where personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles, as required by Australian Privacy Principle 8.

The providers we use may change from time to time. We will update this Privacy Policy when that occurs.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Our measures may include:

• access controls and restricting access to those who reasonably require it;
• authentication and password protections, including multi factor authentication;
• secure technology and cloud based systems;
• encryption of information in transit and at rest where appropriate;
• security measures applied to our website and information systems; and
• procedures for identifying and responding to suspected security incidents.

No method of transmission or electronic storage is completely secure. While we take reasonable steps to protect personal information, we cannot guarantee the absolute security of information transmitted to or from our website.

We ask that you do not send sensitive documents or identification material to us by unencrypted email unless we have agreed a secure method with you.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to operate our business, to meet our legal, regulatory and professional obligations, and to protect our legitimate interests.

Minimum retention periods that apply to our records include:

• five years for records relating to taxation matters, in accordance with taxation law and our obligations as a registered tax agent;
• seven years for records collected and created for the purposes of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), including identification and customer due diligence records;
• seven years for financial records under the Corporations Act 2001 (Cth), where applicable; and
• longer periods where a matter is the subject of a review, audit, dispute, investigation or legal proceeding, or where a longer period is otherwise required by law.

Enquiries received through our website that do not lead to an engagement are generally retained for 24 months and are then securely destroyed or de-identified.

When personal information is no longer required, we take reasonable steps to securely destroy or de-identify it, subject to any legal or regulatory requirement to retain it.

Our website may contain links to third party websites. These websites are not controlled by Lexon and may have their own privacy policies and information handling practices.

We are not responsible for the privacy practices or security of third party websites. We encourage you to review the privacy policy of any third party website before providing personal information.

We may use your personal information to send you information about Lexon, our services, insights, events or other information that may be relevant to you, where permitted by law.

Commercial electronic messages we send are subject to the Spam Act 2003 (Cth). We send those messages only where we have your consent, express or inferred, we identify ourselves as the sender, and we include a functional unsubscribe facility.

You can opt out of receiving marketing communications from us at any time by contacting us or using the unsubscribe facility in the relevant communication.

Opting out of marketing communications will not affect communications relating to an existing engagement or other matters we need to communicate to you.

If we receive personal information that we did not solicit, we will determine whether we could have collected that information in accordance with applicable privacy laws.

Where the information could not lawfully have been collected, we will take reasonable steps to destroy or de-identify it, unless an exception applies.

Where it is lawful and practicable to do so, you may interact with us anonymously or using a pseudonym, for example when making a general enquiry.

This will not be possible where we need to identify you to provide a service, or where we are required by law to verify your identity, including under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and taxation law.

You may request access to personal information that we hold about you by contacting us using the details below.

We will deal with requests for access in accordance with applicable privacy laws. In some circumstances we may be unable to provide access where an exception under the law applies, including where providing access would reveal information relating to another person or would be contrary to a legal obligation.

We do not charge for making a request for access. We may charge a reasonable amount for giving access, for example where retrieving or reproducing records involves significant work. We will tell you about any charge before it is incurred.

If we refuse access, we will generally explain the reason for our decision and, where appropriate, advise you of other options available to you.

We take reasonable steps to ensure that personal information we hold is accurate, complete and up to date.

If you believe that personal information we hold about you is inaccurate, incomplete, out of date or misleading, you may ask us to correct it. We will consider your request and take reasonable steps to correct the information where appropriate.

If we do not agree to correct the information, you may ask us to associate a statement with the record noting that you consider it inaccurate, incomplete, out of date or misleading.

If we become aware of unauthorised access to, unauthorised disclosure of, or loss of personal information that we hold, we will assess and respond to the incident in accordance with our legal obligations.

This includes the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, which applies to eligible data breaches, including breaches involving tax file number information.

Where required by law, we will notify affected individuals and the Office of the Australian Information Commissioner.

If you have a concern about the way we have handled your personal information, please contact us so that we can investigate and address it.

You can make a privacy complaint by contacting:

Privacy Officer, Lexon Advisory Pty Ltd, Level 1, Tower 1, 201 Sussex Street, Sydney NSW 2000. Email: info@lexonadvisory.com.au. Phone: (02) 7820 5050.

Please provide sufficient information for us to understand and investigate your concern.

We will acknowledge your complaint within one business day of receiving it, investigate it, and respond within 30 days. If we need longer, we will tell you why and when you can expect a response.

There is no charge for making a privacy complaint.

If you are not satisfied with our response to your privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

The OAIC can be contacted through its website at www.oaic.gov.au or by telephone on 1300 363 992. The OAIC generally expects individuals to attempt to resolve a complaint directly with the organisation first.

The complaints processes described above relate to the handling of personal information.

If your concern relates to our conduct or services as a registered tax agent, rather than to privacy, you may raise it with us directly using the contact details in this Privacy Policy. If you are not satisfied with our response, you may make a complaint to the Tax Practitioners Board at www.tpb.gov.au.

Information about our registration as a tax agent, and about the Tax Practitioners Board complaints process, is available on the Tax Practitioners Board register.

Our website is intended for an Australian audience and our services are provided in Australia. We do not currently target clients outside Australia.

If you access our website or engage with us from outside Australia, additional data protection laws may apply to the handling of your personal information, including the General Data Protection Regulation in the European Union and the United Kingdom.

Where those laws apply, we will take reasonable steps to comply with them. If you have a query about how your information is handled under those laws, please contact us using the details below.

We may update this Privacy Policy from time to time to reflect changes to our business, website, technology, information handling practices or legal obligations.

The current version will be published on our website and will show the date it was last updated.

If you have any questions about this Privacy Policy, wish to request access to or correction of your personal information, or wish to make a privacy complaint, please contact us:

Lexon Advisory Pty Ltd, ACN 666 823 338, Level 1, Tower 1, 201 Sussex Street, Sydney NSW 2000. Email: info@lexonadvisory.com.au. Phone: (02) 7820 5050.