Various privacy laws apply to Shelcom Corporate Services Australia Pty. Ltd. (ABN 72 769 701 326, ACN 052 129 352).

These laws regulate the way organisations:

• Collect;
• Use;
• Disclose;
• Keep secure; and
• Give people access to their

personal information. (This is information about an individual that identifies them). This policy tells you what information we collect and keep, what we do with it, and what your rights are in relation to that information. Our services are not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children.

Your Personal Information
In order to provide company registration, business name registration, trust deed establishment, self-managed superannuation fund (SMSF) establishment, corporate secretarial services, and a secure login and personal ordering service to our clients, we need to collect and use some personal information. We consider all information about our clients to be private and confidential, and hold ourselves to the highest standards in the safekeeping and use of that information.

Information We Collect About Officeholders, Trustees and SMSF Members
Where we are establishing or maintaining a company, trust, or SMSF on your behalf, we also collect personal information about the directors, secretaries, shareholders, trustees, appointors, and members named in those structures, including:

• Name, date of birth, residential address, email address and phone number;
• Identity verification documents, which are transmitted securely to our identity verification provider, GreenID, for verification. We do not retain copies of these documents after verification is complete;
• Tax File Numbers, where required for SMSF establishment and registration with the Australian Taxation Office;
• Bank account details, for fee processing and, where applicable, trust or SMSF administration; and
• Digital signatures.

Where you provide us with personal information about another individual, you warrant that you have referred them to this Privacy Policy and obtained their permission.

How We Collect Personal Information
We collect personal information directly from you or in the course of our dealings with you, including through:

• Visits to our website and use of our client portal;
• Registration for and use of our services;
• You completing registration tasks, making payments, uploading documents, or providing digital signatures through our client portal;
• Contact via email, telephone, or contact forms; and
• Booking and scheduling through Calendly.

We also collect information from third parties including ASIC, the Australian Business Register, the Australian Taxation Office, our payments processor (Stripe), and our identity verification provider (GreenID) in connection with specific services.

Why We Collect, Hold and Use Your Personal Information
We collect, hold, and use your personal information for the following purposes:

• Providing our services to you, including registering companies, business names, trusts, and SMSFs and lodging associated ASIC, ABR, and ATO forms on your behalf;
• Establishing and maintaining trust deeds, SMSF deeds, and corporate registers;
• Managing our relationship with you, including maintaining your account and responding to enquiries;
• Processing authorised payments;
• Ensuring the security of our website, portal, and services;
• Developing and improving our business, platform, and services;
• Monitoring, research, and analysis of platform usage to improve user experience;
• Accounting, administration, insurance, and risk management;
• Sales, marketing, and customer relationship management activities; and
• Any other purpose permitted or required by law.

Information We Collect From The Web
Each time someone visits our website, our web server collects the following type of information for statistical and verification purposes:

• The number of users who visit the website;
• The number of pages viewed; and
• Traffic patterns

This is anonymous statistical data and no attempt will be made to identify users or their browsing activities. We use this data to evaluate our website performance and to improve the content we display to you. Cookies Our website uses cookies and similar tracking technologies, including:

• Google Analytics, which collects aggregated website usage data and anonymised IP addresses. This does not identify individual users. You may opt out via tools.google.com/dlpage/gaoptout; and
• Smartlook, which records user interactions on our website and client portal to help us improve the user experience. Smartlook does not record sensitive form fields. Contact us if you would like to opt out.

You may control or disable cookies through your browser settings, however this may affect how our website and portal function.

We Will Not Sell Our Client Information
Information about clients is not sold to any other company, individual or group.

We Will Not Release Information About Clients Unless

• We receive their prior written consent;
• We believe the recipient to be the client or their authorised representative;
• The recipient is a government agency or regulator (for example, ASIC, the Australian Business Register, or the Australian Taxation Office) in connection with our services;
• The recipient is a trusted partner, contractor, supplier, or service provider who assists us in providing our services, including the third-party platforms listed below; or
• We are required or authorised by law to release information to the recipient.

Related Entities
Shelcom is a related entity to Waive Pty Ltd (ABN 25 618 672 683), which operates the Waive Portal (a corporate compliance platform) and CleanID (an AML/CTF compliance platform for accounting firms). Where necessary to provide integrated services to clients who have engaged both entities, information may be shared between Shelcom and Waive. Each entity maintains its own Privacy Policy governing its separate services. If you engage Waive’s CleanID service, identity verification carried out for AML/CTF purposes is instead governed by the separate CleanID Verification Privacy Notice, available at waive.com.au/cleanid-privacy-policy/.

Identity Verification
Where identity verification is required to establish or maintain a company, trust, or SMSF, or to complete ASIC, ABR, or ATO forms, we use the Document Verification Service (DVS) and GreenID to verify identity documents against government records. We do not allow anonymous or pseudonymous dealings where identification is required by law.

Third-Party Platforms and Overseas Disclosure
Some of the third-party platforms we use to run our business are located outside Australia. The following table sets out the key platforms, their locations, and the data shared with them. We take reasonable steps to ensure overseas recipients handle your personal information consistently with the Australian Privacy Principles.

Platform	Location	Data Shared	Purpose
Stripe	United States	Payment card details, billing info, names, email addresses	Payment processing
Xero	NZ / United States	Client names, billing data, invoice and payment records	Accounting
Zoho CRM	United States / India	Client contact details, company info, correspondence, CRM notes	Customer relationship management
Zoho Desk	United States / India	Support ticket details, client correspondence, issue history	Customer support
Google Analytics	United States	Website usage data, anonymised IP addresses	Website analytics
Smartlook	EU / United States	User interaction data, navigation patterns (sensitive fields excluded)	Session recording and UX improvement
Calendly	United States	Names, email addresses, phone numbers, appointment details	Scheduling
GreenID (GBG)	Australia	Identity verification documents, name, DOB, address, document numbers (stored by GreenID, not by us)	Identity verification
Third-party contractors	Philippines	Client information necessary to perform contracted services	Administrative and technical support

By using our services you acknowledge that we are not responsible for the privacy practices of third-party platforms.

We May Use Your Information To Tell You About Our Products
Your information may be used by Shelcom Corporate Services Australia Pty. Ltd. to enable us to inform you about new and existing products and services that will enhance our relationship with you. If you provide us with your postal address, e-mail address, or phone number, we may use it to send you our regular communications by mail, email, or SMS. You may, at any time, remove yourself from the marketing list by using the opt-out mechanism in any marketing communication or by advising us in writing.

Security On Our System
All client information is protected from unauthorised access through the use of secure passwords, user log-on or other security procedures. Developments in security and encryption technology are reviewed on a regular basis. Access to client information is restricted to staff and contractors who require it to perform their duties. Where necessary, we will remind our clients that the Internet is an insecure medium.

How Long We Keep Your Information

Record Type	Retention Period
Client records and registration/lodgement data	Retained for the duration of the client relationship, then a minimum of 7 years in accordance with the Corporations Act 2001 (Cth), or longer where required by superannuation or trust law for SMSF and trust records.
Identity verification documents	Held by GreenID in accordance with their retention policies. Not stored by Shelcom after verification is complete.
Website visitor and analytics data	Approximately 30 days, then deleted or anonymised.
Marketing data	Retained while you are an active prospect or client. Inactive prospects with no engagement for 3 years are reviewed and deleted unless you have opted in to ongoing communications.

Once personal information is no longer required, we take reasonable steps to destroy or de-identify it securely.

Where We Hold Your Personal Information
Your personal information is held electronically, primarily in Australia, except where disclosed to the third-party platforms described above. Access is restricted to staff and contractors who require it to perform their duties.

Notifiable Data Breaches
The Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) requires us to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of an eligible data breach. If we believe an eligible data breach has occurred, we will act promptly to assess, contain, and notify as required by law.

Correcting Information
You may request access, view and/or change any personal information we hold about you at any time by logging into this website and visiting My Account. If it is incorrect, we will correct it at your request. We will verify your identity before providing access or making corrections, and will advise you in writing if we are unable to do so, and why.

Complaints
If you have a concern about how we have handled your personal information, please contact us using the details below and provide sufficient detail of your complaint and any supporting evidence. If you are dissatisfied with our response, you may complain to the OAIC at www.oaic.gov.au or by calling 1300 363 992.

Any Questions?
If you have any further questions relating to this privacy statement, or concerns about the way in which we have handled your personal information, please do not hesitate to:

• Email us at support@shelcom.com.au
• Telephone us on 1300 722 796 or
• Write to us at PO Box 282, Ormond VIC 3204, Australia.

Changes To This Privacy Policy
We will update this Privacy Policy from time to time. Where changes significantly affect your rights, we will notify you and provide the updated policy. By continuing to use our website, portal, or services, you are deemed to accept such changes.