Privacy Policy

Effective date: October 7, 2026
Last updated: October 7, 2026

This Privacy Policy explains how MR IT LLC ("MR IT LLC," "we," "us" or "our") collects, holds, uses, discloses and protects personal information when you visit https://mritllc.com (the "Website"), contact us, subscribe to our newsletter or engage us for IT services. It also explains the choices and rights you have, how you can access and correct your information, how to make a complaint, and how to reach us.

MR IT LLC is located in New South Wales, Australia. This policy is written primarily to meet the requirements of the Privacy Act 1988 (Cth) (the "Privacy Act") and the Australian Privacy Principles ("APPs") contained in it. Because our free guides are read by visitors around the world and we work with clients in Australia and internationally, this policy also includes additional information for visitors from the European Economic Area ("EEA") and the United Kingdom, and for residents of US states with consumer privacy laws.

We wrote this policy to be read, not skimmed past. The short version is that our Website is intentionally simple: it is a static site, it does not use third-party analytics, advertising pixels or third-party cookies, and we only receive personal information when you choose to send it to us. The sections below explain the details.

1. Who we are

MR IT LLC is an IT services business located in New South Wales, Australia. We publish free personal-finance guides and calculators and provide IT services that help households, freelancers and small businesses manage money with better technology. Our services include personal finance automation, financial dashboards, accounting and payments integration, financial cybersecurity, fintech website and calculator development, and money and technology workshops. We serve clients in Australia and, remotely, in other countries, and our free guides are read by visitors worldwide.

Whether or not every provision of the Privacy Act applies to a business of our size, we have chosen to handle personal information in accordance with the APPs, and this policy is our APP privacy policy. For the purposes of data protection laws such as the EU General Data Protection Regulation ("GDPR") and the UK GDPR, MR IT LLC is the controller of personal information collected through the Website. For the purposes of US state privacy laws, to the extent they apply, MR IT LLC is the business or controller responsible for that information. When we handle personal information on behalf of a client during a services engagement, we may act as a service provider, contractor or processor to that client, as described in Section 20.

Our contact details are:

• Email: [email protected]
• Phone: 981-9418-5015
• Location: New South Wales, Australia

All privacy questions, requests and complaints should be sent to [email protected]. To help us route your message quickly, please include "Privacy request" or "Privacy complaint" in the subject line.

2. Privacy at a glance

The table below summarizes our practices. It is a convenience only; the full policy controls.

3. Scope of this policy

This policy applies to personal information we collect and hold:

• through the Website, including its articles, calculators, contact form and newsletter sign-up form;
• when you email or phone us directly;
• when you schedule or attend a free consultation, workshop or other meeting with us, whether in person or remotely; and
• when you or your organization engages us for services, to the extent not governed by a separate written agreement.

In this policy, "personal information" has the meaning given in the Privacy Act: information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not. Where this policy refers to "personal data" for EEA and UK visitors, or to "personal information" as defined in US state laws, those terms have the meanings given in the relevant law.

This policy does not apply to websites, apps or services operated by third parties, even if we link to them, such as government resources, banks, software vendors or platforms you use. Those organizations have their own privacy practices, and we encourage you to read their policies. It also does not cover information we handle solely on behalf of a client under a written agreement; in that case the client's privacy policy and our agreement with the client govern.

4. How we apply the Australian Privacy Principles

The APPs set out how organizations should collect, hold, use, disclose and look after personal information. The table below shows, in summary, how each principle applies to the way we work. The remaining sections of this policy explain each point in more detail.

5. Information we collect

We collect as little personal information as practical, and only information that is reasonably necessary for our functions and activities. We collect it directly from you wherever we can. We group it below by how it reaches us.

5.1 Information you provide through the contact form

When you submit our contact form, we receive the information you enter:

Please do not include sensitive information in the message field, such as bank or card account numbers, passwords, one-time codes, tax file numbers, Medicare numbers, Social Security numbers, other tax identification numbers, health information or government ID numbers. We never need that information to respond to an inquiry, and we will never ask you to send passwords or one-time codes by any channel.

5.2 Information you provide through the newsletter form

If you subscribe to our newsletter, we collect your email address. We use it only to send the newsletter and related service messages, such as a confirmation of your subscription. Every newsletter email includes a way to unsubscribe, and you can also unsubscribe by emailing [email protected]. Section 8 explains how we handle direct marketing.

5.3 Information you provide by email, phone or in meetings

If you contact us directly, book a consultation or attend a workshop, we receive whatever information you choose to share, such as your name, contact details, job title, organization, and a description of your goals or technical environment. During services engagements, we may receive additional information described in a separate written agreement or statement of work.

5.4 Information collected automatically through server logs

Like virtually every website, our Website is delivered by a web server operated by our hosting provider. When your browser requests a page, the server automatically records standard technical information in log files, which typically includes:

• your IP address;
• the date and time of the request;
• the page or file requested and the HTTP response status;
• your browser's user agent string (which indicates browser type, version and operating system); and
• the referring URL, if your browser sends one.

We and our hosting provider use these logs only for security, troubleshooting, preventing abuse (for example, blocking automated attacks or spam submissions) and keeping the Website running reliably. We do not use server logs to build profiles of individual visitors, and we do not combine them with other data to identify you except where necessary to investigate a security incident or comply with law.

5.5 Information stored in your browser (localStorage)

The Website uses your browser's localStorage, a storage area on your own device, for three limited purposes: remembering your choice on our cookie and storage notice (mrit_cookie_consent), remembering whether you prefer the light or dark theme (mrit_theme), and remembering whether you have already answered the "Was this helpful?" question on an article (mrit_feedback_<slug>). This information stays in your browser. It is not sent to our servers, and we cannot see it. Our Cookie Policy lists the exact keys we use and explains how to clear them.

5.6 Calculators and interactive tools

Our calculators and self-check tools run entirely in your browser. The numbers and answers you enter are processed on your device to show results and are not transmitted to us or stored on our servers. If you reload or leave the page, those inputs are typically cleared.

5.7 Information we do not collect

To be clear about what does not happen on our Website:

• We do not use third-party analytics, tag managers, heatmaps or session replay tools.
• We do not use advertising pixels, social media tracking pixels or retargeting tags.
• We do not set or allow third-party cookies.
• We do not load fonts, scripts or styles from external content delivery networks, so third parties do not receive your IP address when you load our pages.
• We do not embed third-party social media widgets or video players that track visitors.
• We do not buy personal information from data brokers or other third parties.
• We do not knowingly collect sensitive information (as defined in the Privacy Act, such as health information, racial or ethnic origin, political opinions, religious beliefs or criminal records) through the Website, and we would only collect it with your consent and where reasonably necessary.

5.8 Unsolicited personal information

Sometimes people send us personal information we did not ask for, for example by including account details or information about other people in a contact form message, or by emailing us in error. If we receive unsolicited personal information, we will decide within a reasonable period whether we could have collected it ourselves under the APPs. If we could not have, and it is lawful and reasonable to do so, we will destroy the information or ensure it is de-identified as soon as practicable. If we keep it, we will handle it in accordance with this policy.

5.9 What happens if you do not provide information

You do not have to give us any personal information to read our guides or use our calculators. If you choose not to provide the required fields in our contact form, we may not be able to respond to your inquiry; if you do not provide an email address, we cannot send you the newsletter; and if you do not provide information we reasonably need during an engagement, we may not be able to deliver the services you request.

6. Anonymity and pseudonymity

Under APP 2, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us, unless it is impracticable for us to deal with you that way or we are required or authorized by law to deal with identified individuals.

• Browsing and tools. You can read every article and use every calculator and self-check tool anonymously. We do not ask you to register or log in.
• General questions. You may use a first name only, a nickname or a pseudonym in our contact form or emails when asking a general question. You will need to give us a working email address or phone number so we can reply, but it does not need to reveal your identity.
• Newsletter. You can subscribe with any email address you control.
• Where we may need your identity. It is usually impracticable to provide paid services, issue invoices, verify a request to access or correct personal information, or respond to a formal complaint without knowing who you are. In those situations we will explain what we need and why.

7. How we use information

We use personal information for the primary purpose for which we collected it, as described below, or for a related secondary purpose that you would reasonably expect, with your consent, or where the use is otherwise required or authorized by law.

• To respond to you. We use contact form submissions, emails and phone messages to answer questions, schedule consultations and follow up on your inquiry.
• To provide services. If you become a client, we use the information you provide to scope, quote, deliver, invoice and support the services described in our written agreement.
• To send the newsletter. If you subscribe, we use your email address to send our newsletter until you unsubscribe.
• To operate and secure the Website. We use server logs to keep the Website available, diagnose technical problems, detect and prevent spam, fraud and abuse, and protect our systems and visitors.
• To improve our content and services. We may review the general themes of questions we receive to decide which guides, tools or services to create or improve. We do this without using third-party analytics.
• To meet legal obligations. We may use information to keep business, tax and accounting records, respond to lawful requests, enforce our Terms of Service and protect our rights and the rights of others.

We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not sell, rent or license it to anyone.

8. Direct marketing and our newsletter

We only use personal information for direct marketing in limited ways, consistent with APP 7 and the Spam Act 2003 (Cth):

• Consent first. We send our newsletter and other commercial electronic messages only to people who have subscribed or otherwise consented to receive them. We do not add people to our newsletter simply because they sent us an inquiry.
• Clear sender identification. Every newsletter identifies MR IT LLC as the sender and includes our contact details.
• Easy unsubscribe. Every newsletter includes a functional unsubscribe link. You can also opt out at any time by emailing [email protected] with "Unsubscribe" in the subject line. We will action unsubscribe requests promptly, and in any case within five working days.
• No list sharing. We do not sell, rent or give our subscriber list to other organizations for their marketing, and we do not use or disclose personal information for anyone else's direct marketing.
• Source of information. You may ask us to tell you where we obtained your personal information for direct marketing, and we will do so unless it is impracticable or unreasonable.

Even after you unsubscribe, we may still send you messages that are not marketing, such as replies to your inquiries or messages about services you have engaged us to provide.

9. How we disclose information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only in the limited circumstances below.

9.1 Service providers

We use a small number of service providers who handle personal information on our behalf and under our instructions, such as:

• our website hosting provider, which serves the Website, runs the server-side mail handler and processes server logs;
• our email service provider, which delivers form submissions to our inbox and carries our email correspondence;
• a newsletter delivery service, if and when we use one to send our newsletter; and
• productivity, file storage, accounting and video conferencing tools we use to communicate with prospects and clients and to run our business.

We require service providers to use personal information only to provide services to us, to protect it with appropriate safeguards and not to sell it or use it for their own advertising purposes.

9.2 Professional advisers

We may share information with our lawyers, accountants, tax agents, insurers and other professional advisers where needed for them to advise us, under duties of confidentiality.

9.3 Legal requirements and protection

We may disclose information if we believe in good faith that it is required or authorized by an Australian law, a court or tribunal order, or other applicable law or legal process, or that disclosure is reasonably necessary to lessen or prevent a serious threat to the life, health or safety of any individual or to public health or safety, to take appropriate action in relation to suspected unlawful activity or serious misconduct, or to protect the rights, property or safety of MR IT LLC, our clients, visitors or the public, including to detect, prevent or address fraud, security or technical issues.

9.4 Business transfers

If MR IT LLC is involved in a merger, acquisition, financing, reorganization, sale of assets or similar transaction, personal information may be transferred as part of that transaction. We will take reasonable steps to ensure the recipient honors this policy, and we will notify you if your information becomes subject to a materially different privacy policy.

9.5 With your direction or consent

We may share information with other parties when you ask us to or give us permission, for example when you ask us to coordinate with your bookkeeper, accountant or IT provider during an engagement.

10. Cross-border disclosure and international transfers

10.1 Disclosure outside Australia (APP 8)

We are located in Australia, but some of the service providers we rely on, particularly our website hosting provider and our email and productivity service providers, may store or process personal information on servers located outside Australia. Depending on the provider and its infrastructure, this may include data centres in the United States, the European Union, the United Kingdom, Singapore or other countries where those providers or their subprocessors operate. Because the location of cloud infrastructure can change, we cannot list every country in advance, but you may contact us to ask about the providers and locations we currently use.

Before personal information is disclosed to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to that information, for example by choosing established providers that offer contractual privacy and security commitments, encryption in transit and at rest, and access controls. In some cases, we may disclose information overseas with your consent or where another exception under APP 8 applies, such as where the disclosure is required or authorized by law. If you contact us from outside Australia, your communications will necessarily travel across international networks.

10.2 Transfers from the EEA and UK

If you are located in the EEA or the United Kingdom, personal data you send us will be transferred to Australia and may also be processed in the other countries mentioned above, where data protection laws may differ from those in your country. Where the GDPR or UK GDPR applies to such transfers, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where our service providers offer them, an applicable adequacy decision for the destination country, or, for transfers necessary to respond to your inquiry or perform a contract you requested, the derogations permitted by law. You may contact us for more information about the safeguards we use.

11. Data retention

We keep personal information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law. When information is no longer needed for any purpose permitted under the APPs and we are not required by law to keep it, we take reasonable steps to destroy it or de-identify it. The table below describes our standard retention periods.

12. How we protect information

We take security seriously, which is fitting given that financial cybersecurity is one of the services we provide. Consistent with APP 11, we take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorized access, modification or disclosure. Our safeguards include:

• serving the entire Website over HTTPS so data in transit is encrypted;
• a static site architecture with no database of visitor information and no third-party scripts, which reduces the attack surface;
• server-side validation and spam protection on our forms;
• strong, unique passwords stored in a password manager and multi-factor authentication on the accounts we use to run our business;
• limiting access to personal information to people who need it to respond to you or deliver services;
• keeping devices and software updated and using full-disk encryption on devices that store business data; and
• never requesting or storing client passwords; where account access is needed for an engagement, we require explicit written authorization and prefer read-only roles.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Email in particular is not always encrypted end to end, which is one reason we ask you not to send sensitive financial information through our forms or by email.

12.1 Notifiable data breaches

If we suspect that personal information we hold has been subject to unauthorized access, unauthorized disclosure or loss, we will act quickly to contain the incident and take reasonable steps to assess it, aiming to complete that assessment within 30 days. Where the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act applies, and an incident is an eligible data breach, meaning it is likely to result in serious harm to one or more individuals and we have not been able to prevent that likely risk of serious harm through remedial action, we will notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable. Our notification will describe the breach, the kinds of information involved and the steps we recommend you take in response.

If a security incident affects visitors or clients outside Australia, we will also notify affected individuals and the relevant authorities where required by the laws of their jurisdiction, such as the GDPR, the UK GDPR or US state breach notification laws.

13. Accessing and correcting your personal information

13.1 Access (APP 12)

You may ask us for access to the personal information we hold about you. To make a request, email [email protected] with "Privacy request" in the subject line, tell us what information you would like to access and, if possible, how you would like to receive it. We do not charge you for making a request. If giving access involves significant time or cost, we may charge a reasonable fee for providing access, but we will tell you the amount before we proceed, and we will not charge an excessive amount.

We will respond to your request within a reasonable period, and we aim to do so within 30 days. In limited circumstances permitted by APP 12, we may refuse access, or provide access in a different way, for example where giving access would have an unreasonable impact on the privacy of others, where the request is frivolous or vexatious, where the information relates to existing or anticipated legal proceedings, or where giving access would be unlawful. If we refuse, we will give you written reasons, unless it would be unreasonable to do so, and tell you how to complain.

13.2 Correction (APP 13)

We take reasonable steps to ensure the personal information we hold is accurate, up to date, complete, relevant and not misleading. If you believe information we hold about you is incorrect, please email [email protected] with "Privacy request" in the subject line and tell us what should be changed. We will respond within a reasonable period, aiming to do so within 30 days, and we do not charge for making a correction request or for correcting information.

If we have previously disclosed the information to another organization subject to the APPs, you may ask us to notify them of the correction, and we will do so unless it is impracticable or unlawful. If we decide not to correct the information, we will give you written reasons and tell you how to complain, and you may ask us to associate with the information a statement that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. We will take reasonable steps to do so in a way that makes the statement apparent to users of the information.

13.3 Verifying your identity

To protect your information, we will take reasonable steps to verify your identity before giving access to, correcting or deleting personal information. Because we hold very little information, verification usually means confirming that you control the email address associated with your inquiry or subscription. We will not ask for more information than necessary, and we will use information provided for verification only for that purpose.

14. How to make a privacy complaint

If you are concerned that we have not handled your personal information in accordance with this policy, the APPs or another applicable privacy law, we would like the opportunity to put things right. Our complaint process is as follows:

1. Contact us first. Email [email protected] with "Privacy complaint" in the subject line, or call us on 981-9418-5015. Please describe your concern, what happened and when, and what outcome you are seeking. Include any relevant correspondence.
2. Acknowledgement. We will acknowledge your complaint promptly, usually within a few business days, and may contact you if we need more information.
3. Investigation and response. We will look into your complaint fairly and respond to you in writing within 30 days. If a complex matter needs more time, we will tell you why and when you can expect to hear from us.
4. Escalation to the regulator. If you are not satisfied with our response, or we have not responded within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). Information about how to make a complaint is available at www.oaic.gov.au.

Visitors in the EEA and UK may also complain to their local data protection authority, and US residents may contact the attorney general or privacy regulator in their state, as described in Sections 15 and 16.

15. Visitors from the EEA and UK

This section applies if you are located in the European Economic Area or the United Kingdom and the GDPR or UK GDPR applies to our processing of your personal data, for example because you contact us from there or engage our services remotely.

15.1 Legal bases for processing

Where we rely on legitimate interests, we have considered your rights and expectations and concluded that our processing is limited and proportionate.

15.2 Your rights

Subject to certain conditions and exceptions, you have the following rights:

• Access: to obtain confirmation of whether we process your personal data and a copy of it.
• Rectification: to have inaccurate or incomplete personal data corrected.
• Erasure: to have your personal data deleted in certain circumstances.
• Restriction: to ask us to limit how we use your personal data in certain circumstances.
• Portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Withdraw consent: where we rely on consent, to withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Complaint: to lodge a complaint with your local data protection supervisory authority, or in the UK with the Information Commissioner's Office. We would appreciate the chance to address your concerns first.

To exercise these rights, email [email protected] with "Privacy request" in the subject line. We will respond within one month of receipt, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive. International transfers of your personal data are described in Section 10.2.

16. Visitors from the United States: state privacy rights

Many of our guides are read by visitors in the United States, and a growing number of US states have comprehensive consumer privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, among others. Some of these laws may not apply to a business of our size or location, and their requirements differ. Regardless of whether a particular law applies to us, we have chosen to extend the core rights below to visitors who reside in the United States, subject to verification and legal exceptions.

16.1 Rights we offer

• Right to know and access. You may ask us to confirm whether we process your personal information and to provide the categories and specific pieces of information we hold about you.
• Right to correct. You may ask us to correct inaccurate personal information.
• Right to delete. You may ask us to delete personal information we collected from you, subject to exceptions such as completing a transaction, security, legal compliance and record-keeping obligations.
• Right to data portability. You may ask for a copy of your personal information in a portable, readily usable format.
• Right to opt out. You may opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising and profiling in furtherance of decisions with legal or similarly significant effects. We do not engage in any of these activities, but you may still submit an opt-out request and we will record it.
• Right to limit use of sensitive personal information. We do not knowingly collect or use sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination. We will not deny you services, charge you different prices or provide a different quality of service because you exercised your privacy rights.
• Right to appeal. If we decline to take action on your request, you may appeal our decision as described in Section 16.5.

16.2 Additional information for California residents

This section provides additional information for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), to the extent it applies. In the preceding 12 months, we have collected the following categories of personal information, from the sources and for the purposes described below.

We do not sell personal information and have not sold it in the preceding 12 months. We do not share personal information for cross-context behavioral advertising and have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. Retention periods for each category are described in Section 11.

Shine the Light. California Civil Code Section 1798.83 allows California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

Financial incentives. We do not offer financial incentives or price differences in exchange for personal information.

16.3 How to submit a request

To exercise any of these rights, email [email protected] with "Privacy request" in the subject line and tell us which right you want to exercise and the email address you used to contact us. We will acknowledge your request and respond within the time required by applicable law, generally within 45 days, which may be extended once by an additional 45 days where reasonably necessary, in which case we will let you know.

16.4 Verification and authorized agents

We will verify your identity as described in Section 13.3 before fulfilling requests to access, correct or delete personal information. You may use an authorized agent to submit a request on your behalf where permitted by law. We may require the agent to provide proof of written authorization and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

16.5 Appeals

If we decline to act on your request, in whole or in part, we will explain why. You may appeal by replying to our decision or emailing [email protected] with "Privacy appeal" in the subject line within a reasonable time. We will respond to your appeal in writing within the period required by applicable law, generally 45 to 60 days, and explain the outcome. If you are not satisfied with the result, you may contact the attorney general or privacy regulator in your state.

17. Do Not Track and Global Privacy Control

Global Privacy Control (GPC). GPC is a browser setting or extension that signals your choice to opt out of the sale or sharing of your personal information. We honor GPC signals as a valid request to opt out of sale, sharing and targeted advertising for that browser, wherever you are located. Because we do not sell or share personal information or engage in targeted advertising, honoring the signal does not change how the Website works for you, and you will not see a different experience.

Do Not Track (DNT). Some browsers send a "Do Not Track" header. There is no common industry standard for how websites should respond to DNT. Because the Website does not track visitors across sites or over time for advertising or analytics, there is no tracking for DNT to turn off; our practices are the same whether or not your browser sends the signal.

18. Your choices

• Don't provide it. You can browse the Website and use every guide and calculator without giving us any personal information.
• Use a pseudonym. For general questions, you may contact us without using your real name, as described in Section 6.
• Optional fields. Phone number, company and budget range are optional on our contact form; leave them blank if you prefer.
• Unsubscribe. Use the unsubscribe link in any newsletter or email [email protected].
• Clear browser storage. You can clear localStorage for mritllc.com at any time through your browser settings. See our Cookie Policy for instructions.
• Privacy signals. You can enable Global Privacy Control in a supporting browser or extension; we honor it as described in Section 17.
• Exercise your rights. You can request access, correction or deletion as described in Sections 13, 15 and 16, and make a complaint as described in Section 14.

19. Children's privacy

The Website and our services are intended for adults and are not directed to children. Our forms are designed for adults inquiring about services or subscribing to a newsletter, and we do not knowingly collect personal information from children. In particular, we do not knowingly collect personal information from children under 13 years of age, consistent with the US Children's Online Privacy Protection Act (COPPA) for visitors from the United States, and, for visitors in the EEA and UK, we do not knowingly collect personal data from anyone under 16 years of age, or the lower age set by local law, without verifiable consent from a parent or guardian. In Australia, where we deal with a young person, we consider whether they have the capacity to make their own privacy decisions and, where they do not, we will deal with a parent or guardian.

If you are a parent or guardian and believe your child has provided personal information to us, please email [email protected] with "Privacy request" in the subject line and we will delete it promptly. Educational workshops we deliver for schools or youth programs are arranged with the organizing institution and do not involve collecting personal information from participants.

20. Information handled during client engagements

Some of our services involve working with a client's systems, such as accounting software, spreadsheets, payment platforms or device settings. In these engagements:

• the scope of any data access is defined in a separate written agreement or statement of work;
• we do not access any account without the client's explicit written authorization, and we use read-only access wherever the platform allows;
• we never ask for or store client passwords or one-time codes; clients enter their own credentials or grant role-based access that they can revoke at any time;
• we do not hold, transfer or move client funds;
• we handle client data only to deliver the agreed services and do not use it for our own marketing; and
• at the end of the engagement, we return or delete client data as specified in the agreement, subject to legal record-keeping obligations.

Where a client's own customers or employees are involved, the client is responsible for providing any required notices to those individuals, and we act as a service provider, contractor or processor under the client's instructions.

21. Third-party links

Our articles link to external resources we consider useful, such as consumerfinance.gov, IdentityTheft.gov, AnnualCreditReport.com, irs.gov and fdic.gov, and we may also point readers to official resources in other countries, such as Australian government websites. When you follow a link, you leave our Website, and the destination site's privacy practices apply. We do not control and are not responsible for the content or privacy practices of other websites. Because we do not embed third-party content, simply viewing our pages does not send your information to those sites.

22. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, the Website or the law. When we do, we will update the "Last updated" date at the top. If we make material changes, such as adding analytics, advertising or a new category of personal information, we will provide prominent notice on the Website before the change takes effect and, where required by law, ask for your consent. We encourage you to review this policy periodically.

If we ever decide to introduce any third-party analytics or advertising technology, we will update this policy and our Cookie Policy first and explain what is changing and why.

23. How to contact us

If you have questions, concerns, requests or complaints about this Privacy Policy or how we handle personal information, please contact us:

• Email: [email protected]
• Phone: 981-9418-5015
• Location: New South Wales, Australia
• Website: Contact page

We use a single email address for all inquiries. To help us route your message, please include "Privacy request" (for access, correction, deletion or other rights requests) or "Privacy complaint" in the subject line. We aim to acknowledge privacy-related messages within a few business days and to respond in full within 30 days. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au. Related documents: Terms of Service, Cookie Policy and Disclaimer & Editorial Policy.