Privacy Policy

Last updated: 16 June 2026 (v1.1)
Policy Owner: Chris Cathie (Director / Privacy Officer)

1. Purpose

This Privacy Policy outlines how Lyros Pty Ltd (ABN 46 689 015 165), trading as Lyros Accounting ("Lyros", "we", "us", "our"), manages personal information. It covers our collection, holding, use, and disclosure practices related to our professional services, website interactions, marketing, and potential employment activities. We are committed to protecting your privacy and handling your personal information responsibly. We endeavour to take all reasonable steps to comply with the Australian Privacy Act 1988 (Cth) (the "Act") and the Australian Privacy Principles (APPs).

2. Personal Information Collected by the Company

2.1 What is Personal Information? In this Policy, personal information has the meaning given in the Act. Generally, it refers to information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2.2 What Kinds of Personal Information Do We Collect and Hold? We collect personal information relevant to our dealings with clients, potential clients, suppliers, potential employees, and contractors. The specific types of information depend on the nature of your interaction with us. This may include:

• Identity and Contact Data: Your name, email address, phone number(s), and address.
• Client Engagement Data: Information about the services you inquire about or receive (e.g., CFO advisory, automation projects), communications related to service delivery, support requests, and feedback.
• Financial and Billing Data: Information necessary for us to provide services and receive payment, such as billing addresses or bank account details for payment processing. We may also collect details related to your business (like directorships or investments) if relevant to the services we provide.
• Recruitment Data: If you apply for a role with us, information included in your application (e.g., resume, references), interview notes, and results from pre-employment checks (if applicable). Government identifiers like Tax File Numbers may be collected if required by law for employment.
• Website Usage and Location Data: Technical and usage information automatically collected when you visit our website (the "Site"). This includes your device type, browser name and version, operating system, screen and window size, and language; the pages you view (recorded as the page path only, never the query string), the page title, your landing page, and the website you arrived from (recorded as the referring site's domain only); approximate location and network information derived from your IP address (country, region or city, postcode, approximate coordinates, time zone, and the organisation or internet provider associated with your network); the marketing campaign, source, medium, term and content that brought you to us, together with any advertising click identifiers (such as Google, Microsoft and Meta click IDs) present in the link you followed; and two random, anonymous identifiers stored by your browser, one for the current session and one that persists between visits so we can recognise a returning visitor. These identifiers are random values only and are not linked to your name, email or any other information that identifies you. We mask your IP address at our end (the final part is dropped, for example 203.0.113.xxx) and never store the full IP address. Section 4 explains this collection in full and how to switch it off.
• Sensitive Information: We generally do not need to collect sensitive information (like health data or criminal records) for our standard services. If collecting sensitive information becomes necessary for a specific service or legal requirement (e.g., certain employee checks), we will only do so with your consent or as permitted by law.

2.3 How Do We Collect Personal Information? We collect personal information directly from you when you:

• Contact the Company (e.g., via email, phone, or our website contact form).
• Engage with us to provide services (e.g., to provide CFO advisory or automation services).
• Participate in a consultation or strategy call.
• Interact with our website.
• Apply for employment or a contractor position.
• Attend events and information sessions conducted by the Company.

In some situations, we might collect information from other sources, such as:

• Publicly available sources (e.g., company websites, ASIC register).
• Third parties you authorise to provide information to us (e.g., your existing accountant, referees during recruitment).
• Automatically via cookies, first-party analytics, and similar technologies when you use our website.

Notification of Collection: When we collect personal information directly from you, we will take reasonable steps to notify you (or ensure you are aware) of certain matters required by the Privacy Act. This typically includes our identity and contact details, the purposes for collection, the consequences if information isn't provided, the types of third parties we usually disclose to, information about how to access/correct your data or make a complaint, and whether we are likely to disclose the information overseas (and if so, where). This information may be provided through this Privacy Policy, specific collection statements (e.g., on our website forms), or other communications.

Anonymity and Pseudonymity: You have the option to interact with us anonymously or use a pseudonym for general inquiries. However, providing our services (especially financial services) typically requires us to know your identity. If you choose not to provide necessary personal information, we may be unable to provide the requested services or respond effectively.

3. Use and Disclosure of Personal Information

3.1 Why We Use and Disclose Personal Information: We use and disclose personal information for the primary purpose for which it was collected, for related secondary purposes you would reasonably expect, or as otherwise permitted or required by law.

Our main purposes include:

• Providing Services: Delivering our CFO advisory, finance automation, and related advisory services to you.
• Client Communication: Communicating with you regarding service delivery, responding to inquiries, providing updates, and managing our client relationship.
• Business Operations: Managing our internal business needs, such as invoicing, payments, administration, IT support, and service improvement.
• Recruitment: Assessing applications for employment or contractor roles.
• Marketing and Events: Informing clients and contacts about services, insights, or events that may be relevant to them (subject to opt-out rights).
• Marketing Attribution: Measuring which campaigns and referrals bring visitors to our website, including the campaign parameters and advertising click identifiers contained in the links visitors follow, so we can understand which activity is effective.
• Legal Compliance: Meeting our legal and regulatory obligations.

3.2 Disclosure to Third Parties: We may need to disclose your personal information to third parties to facilitate these purposes. This may include:

• Service Providers: Third parties who assist us in operating our business, such as IT support, cloud storage providers (see Section 7), payment processors, and professional advisors (lawyers, accountants). We take reasonable steps to ensure these providers handle your information securely and only for the purposes we engage them for.
• Recruitment Support: Third-party providers involved in our recruitment process (e.g., background check services), where applicable and with your consent.
• Legal and Regulatory Bodies: Disclosure may be required to regulators (like ASIC or the ATO), law enforcement agencies, or courts, as required or authorised by law.
• Business Transfers: If our business is sold or merged, personal information may be transferred to the new owner, subject to confidentiality obligations.

3.3 Recruitment Information: Information provided by unsuccessful job applicants may be retained for consideration for future roles, unless you request otherwise. We may require consent for background checks as part of the application process.

3.4 Marketing Communications: We may use your contact details to send you information about our services or industry insights we believe may interest you. You can opt-out of receiving these communications at any time by using the unsubscribe link in emails or by contacting us directly. We will not sell your personal information to third parties for their marketing purposes.

4. Privacy on Our Website

You can generally browse our website (the "Site") without providing personal information. However, certain functions (like submitting a contact form) require you to provide details. If you choose to remain anonymous or use a pseudonym, our ability to respond or provide services may be limited.

Cookies, analytics and similar technologies. We use cookies (small text files stored on your device) and our own first-party analytics on the Site to understand how it is used, to measure which marketing activity is effective, to improve the Site, and to recognise returning visitors so we can gauge engagement over time. We do not use this information to build a profile that identifies you personally, and we do not sell it.

What our website analytics records. When you browse the Site, our first-party analytics beacon records technical and usage information about your visit. This does not include your name, email address or any contact details. It includes:

• Your device and browser: device type, browser name and version, operating system, screen and window size, and language.
• Your page activity: the pages you view (recorded as the page path only, never the query string), the page title, the page you landed on, and the website you arrived from (recorded as the referring site's domain only, not the full address).
• Your approximate location and network: country, region or city, postcode, approximate coordinates, time zone, and the organisation or internet provider associated with your network, all derived from your IP address. Your IP address itself is masked, the final part is dropped (for example 203.0.113.xxx), and the full IP address is never stored.
• Campaign and referral details: the marketing campaign, source, medium, term and content that brought you to us, and advertising click identifiers (such as Google, Microsoft and Meta click IDs) where present in the link you followed.
• Two random, anonymous identifiers stored by your browser: a session identifier that lasts only until you close the browser tab, and a visitor identifier that persists on your device between visits so we can tell whether you are a new or returning visitor. These identifiers are random values only; they are not linked to your name, email or any other information that identifies you.

How long we keep website analytics information. We retain website analytics information only for as long as it is needed for the purposes described above, and then delete it or aggregate it into non-identifiable summaries. Masked IP addresses are never stored in raw form.

Your choices. You can switch our analytics off entirely. If your browser sends a "Do Not Track" or "Global Privacy Control" (GPC) signal, our beacon does not run and collects nothing for your visit. You can also block it on your own device by setting a localStorage value named "block_tracking" to "true" for this Site. You can clear the stored identifiers at any time by clearing this Site's data in your browser, which resets you to a new visitor. Most web browsers also allow you to control cookies through their settings, including disabling them, although disabling cookies may affect the functionality of the Site.

Third-Party Links: Our Site may contain links to websites operated by third parties. Clicking these links will take you to external sites subject to their own privacy policies. We are not responsible for the privacy practices or content of these third-party websites.

International Users: Our Site is operated in Australia and intended for users within Australia. While accessible globally, its terms and practices are based on Australian law. If you access the Site from outside Australia, you do so at your own risk and are responsible for compliance with local laws. The protections described above, including IP masking and the Do Not Track, Global Privacy Control, and "block_tracking" opt-outs, apply to all visitors regardless of location.

5. Data Security and Integrity

5.1 Security Measures: We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure. These steps include implementing appropriate technical measures (such as access controls, encryption where suitable), physical security for any paper records, and administrative processes (like staff training and confidentiality agreements).

5.2 Data Integrity: We also take reasonable steps to ensure the personal information we collect, use, or disclose is accurate, complete, and up-to-date. We may periodically ask you to confirm or update your details. Please inform us promptly if any of your personal information changes.

6. Access and Correction Details

You may request access to or correction of any personal information we hold about you at any time by contacting us using the details below. We treat all requests for access seriously.

All requests will be dealt with in a timely manner, and we will endeavour to respond within 30 days. We will provide access in accordance with the Privacy Act, subject to any applicable exemptions. If you find that the personal information we hold about you is inaccurate, incomplete, or out-of-date, please contact us immediately via the contact details below and we will correct it.

An individual's right to access their personal information is not absolute. We may deny access to personal information if:

• the request does not relate to the personal information of the person making the request;
• the request is frivolous or vexatious;
• providing access would pose a serious and imminent threat to the life or health of a person;
• providing access would create an unreasonable impact on the privacy of others;
• the request relates to existing or anticipated legal proceedings;
• providing access would prejudice negotiations with the individual making the request;
• access would be unlawful;
• denial of access is authorised or required by law;
• access would prejudice law enforcement activities;
• access discloses a 'commercially sensitive' decision-making process or information; and/or
• any other reason that is provided for in the APPs set out under the Act.

If we deny access to personal information, we will provide the person seeking access with written reasons.

There is generally no charge for making a request for access to personal information. However, individuals may be required to pay reasonable costs imposed by us for providing the requested personal information, such as for photocopying or accessing information stored off-site.

7. International Transfers and Data Retention

International Transfers: We primarily store personal information in servers located in Australia. However, we may disclose personal information to third-party service providers located overseas (e.g., cloud service providers like Microsoft and Google Cloud) to provide our services and obtain necessary support. We take reasonable steps to ensure that any overseas recipient does not breach the APPs in relation to the personal information disclosed to it. Any such transfer does not change our commitment to safeguard the privacy of your personal information.

Data Retention: We retain your personal data for as long as we have a relationship with you and for a necessary period afterward (e.g., to comply with legal, tax, or accounting requirements). Website analytics information is retained as described in Section 4. Once no longer required for any purpose for which the information may be used or disclosed under the APPs, and we are not required by law or a court/tribunal order to retain it, we will take reasonable steps to delete or de-identify the personal information.

8. Notifiable Data Breaches Scheme

In the event of a data breach involving personal information that is likely to result in serious harm, we will assess the breach and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the requirements of the Privacy Act.

9. Complaints

If you have any questions, concerns, or complaints about this policy or our handling of your personal information, please contact us in writing using the details below. We will investigate your complaint and aim to respond within a reasonable period to resolve the issue in a timely and efficient manner.

If you are dissatisfied with our response to your complaint, you can contact the Office of the Australian Information Commissioner (OAIC). See www.oaic.gov.au for how to make a complaint.

10. Changes and How to Contact Us

We may change this Privacy Notice from time to time at our discretion. Amendments will be posted on our website. Your continued use of our services signifies your agreement to the Privacy Notice as amended.

For privacy inquiries, to request access to or correction of your data, or to submit a complaint, please contact:

Chris Cathie
Lyros Pty Ltd
chris@lyros.com.au

‍