Elliott May Lawyers Pty Ltd
ABN 27 152 319 198

Last updated: 22 June 2026

 

1. Introduction

This Privacy Policy applies to Elliott May Lawyers Pty Ltd (‘Elliott May’, ‘we’, ‘us’ and ‘our’) and any of its associates and subsidiaries.

Elliott May collects and holds personal information from various sources in the ordinary course of fulfilling our duties to the court, our clients and shareholders and in day to day management of its business. This includes collecting and holding personal information pertaining to:

  • Clients;
  • Potential clients;
  • Suppliers;
  • Consultants; and
  • Employment applicants.

We recognise that your privacy is important to you, and we are committed to protecting your privacy and handling your personal information in an open and transparent way.

 

2. What does this Privacy Policy cover?

This Privacy Policy explains how we collect, handle, store and protect personal information when:

  • We provide services to you and our clients.
  • You use our website and/or our services.
  • We perform any other activities that form part of the operation of our business.

 

3. What laws apply to us?

When handling personal information we are required to comply with the Privacy Act 1988 (Cth) (‘Privacy Act’) which contains the Australian Privacy Principles (‘APPs’). In addition, we are required to comply with other applicable legislation, such as Australian State and Territory health privacy legislation, as well as the Spam Act 2003 (Cth) (‘Spam Act’) and the Do Not Call Register Act 2006 (Cth).

The APPs are legally binding principles that are designed to ensure that individuals’ personal information is protected throughout the information lifecycle, i.e. from the time the information is collected through to its destruction. The APPs also give individuals the right to access their personal information, and have it corrected if it is incorrect.

A summary of the Australia Privacy Principles, a copy of the Privacy Act and additional information about privacy is available on the website of the Office of the Australian Information Commissioner at www.oaic.gov.au.

 

4. Personal information

4.1 What is personal information?

‘Personal information’ is information from which your identity is reasonably apparent, e.g., your name and contact details. This information may include information or an opinion about you, whether true or not.

4.2 What is sensitive information?

‘Sensitive information’ is a subset of personal information that is given a higher level of protection under the APPs. Sensitive information includes information relating to your racial or ethnic origin, political persuasion, memberships in trade or professional associations or trade unions, sexual preferences, criminal record, biometric information or health (including predictive genetic information).

Generally, we do not collect or hold sensitive information and will only collect sensitive information about you with your consent.

4.3 Types of personal information we collect

The main types of personal information we may collect include, but are not limited to the following:

  • Names and contact details, including phone numbers, postal and/or residential addresses and email addresses.
  • Information that can identify you, including date of birth or residence status; drivers licence number, passport details, marital status and photographs.
  • Any facts or opinions that are connected to an enquiry that we are conducting on behalf of a client or potential client to effectively provide legal services, including occupation and employment details, bank account details and financial information.
  • Any other personal information that is provided through a website, mobile application or other online platform belonging to Elliott May or as otherwise requested by us or provided by you.

5. Use of personal information

5.1 Purpose of collection and use

    We will only use your personal information for the purpose for which you have provided it, as permitted by this Privacy Policy, or otherwise in accordance with the APPs and Privacy Act. We will not disclose your personal information to third parties, unless you have consented to such disclosure or in other circumstances where such disclosure is required or permitted by law.

    We generally only collect, receive, use, disclose and otherwise process personal information where it is reasonably necessary for us to do so and for the primary purposes of providing you with our legal services or where it is directly related to one of more of the functions and activities of our business.

    We also process information about you for the following related purposes:

    • Contacting and communicating with you.
    • Determining if we are able to assist you with your legal matter.
    • Assessing and processing inquiries and requests for legal services.
    • Securing litigation and/or disbursement funding.
    • Market research, surveys, analysis and business development and marketing, including direct marketing.
    • Measurement, analytics and profiling to improve the effectiveness and distribution of business development and marketing activities, including direct marketing.
    • Analysing and improving our legal services business (e.g., by reviewing data about our matter management processes and financial performance to identify areas for improvement to enhance your client experience).
    • Conducting the effective management of our business, such as invoicing and account management (including debt collections), internal record keeping, financial modelling and analysis.
    • Making our websites, mobile applications and other on-line platforms more intuitive and personalised, including by the use of device data (IP address, unique device identifier, cookies and other data linked to usage of our on-line platforms) and your activity whilst using these on-line platforms.
    • Seeking consent in relation to publications of reviews and testimonials.
    • Running competitions and offering additional benefits to you.
    • Sending promotional information about third parties that we think may be of interest to you.
    • Recruitment and onboarding.
    • The employment of our personnel and providing internal services to our employees;
    • Compliance with our legal obligations and for establishing, exercising or defending legal proceedings.
    • To verify your identity and to comply with our obligations under the anti-money laundering and counter-terrorism financing laws.
    • To inform you about any relevant legal services provided by us.
    • Other purposes related to our business.

    5.2 Direct marketing

    We may send you direct marketing communications and information about our product and services. You may also receive direct marketing communications and information from businesses that we have a relationship with. This may take the form of emails, SMS, mail, social media posts/notifications or other forms of communication, in accordance with the Spam Act and the Privacy Act.

    If you do not wish to receive marketing information, you may at any time decline to receive such information by contacting us using the details listed below.

    If the direct marketing is by email you may also use the unsubscribe function. We will not charge you for giving effect to your request and will take all reasonable steps to meet your request within a reasonable timeframe.

     

    6. Collection of personal information

    6.1 How we collect personal information

    We collect your personal information in a number of ways, which can broadly be categorised as set out below. By providing personal information, you consent to your information being disclosed and held in accordance with this Privacy Policy.

    6.1.1 Information that comes directly from you

    Generally, we will collect your personal information directly from you either verbally, in writing or from your provided documents. Examples of how we collect your personal information include when you have a face-to-face meeting with us, call us or communicate with us via email, post, social media channels, surveys or our website, or respond to questionnaires, surveys or market research.

    We may also monitor and record telephone calls from you for training, compliance and security purposes. You are not obligated to provide the requested information; however, if it is not provided, then we may be unable to provide the legal services you require or request.

    6.1.2 Information from third parties

    We often collect your personal information from external professional sources (i.e. health professionals, financial advisors, accountants, other legal parties and their legal advisors). With the exception of personal information obtained from opposing legal parties, this personal information will, in the usual course, be obtained under your express authority or within the scope of the instruction you have provided us and will be securely stored on your file.

    Where permitted by law, we may also collect and receive information from third parties, including the following:

    • Publicly available registers (such as  Australian Securities and Investments Commission (ASIC), Australian Business Register (ABR)), social media platforms (such as Facebook and Instagram), websites and other sources.
    • Referral sources, service providers, agents, advisors or your family members.
    • Material provided under freedom of information, health records and other legislation.
    • Taxation records from the Australian Taxation Office (ATO).
    • Information from other government agencies.
    • Security-related or identity verification services.
    • Medical records and information from treating doctors and other health professionals.
    • Statements from policing authorities and witnesses, if relevant.
    • Employment records and information from current or previous employers.
    • Financial information from accountants and financial advisors.
    • Claims records and other information from insurers.
    • Market research companies and consultants that help us with our market research, analysis and business development activities.
    • Data analytics companies and consultants that help us to analyse and improve our legal services business.

    6.1.3 Information from your use of our website

    We collect information about you from our website and social networking services. We use this information and feedback to assist you in your website navigation and to improve our services and web content.

    We use cookies for a range of purposes such as helping you navigate between pages efficiently, remembering any preferences you have set and ensuring that the online advertisements you see are more relevant to you. Cookies also allow us to analyse user behaviours and help us make informed decisions on how to improve your experience with our website.

    If you do not wish for this to occur, you can remove cookies from your computer, by following the standard procedures for your internet browser to do so.

    In addition, whenever you lodge a support query using our “Help” or “Contact us” features on our website, then we collect your name and email address, in order to be able to reply to you and provide the support or advice requested.

    6.1.4 Excluded activities

    We do not use address-harvesting software to collect personal information.

    6.2 Providing personal information about someone else

    If you provide us with someone else’s personal information, you should only do so if you have their authority or consent to provide us with their personal information. You should also take reasonable steps to inform them of the matters set out in this Privacy Policy. By providing someone else’s personal information, you warrant to us that you are authorised to provide us with that information.

    6.3 Holding personal information

    We will keep and use your personal information:

    • Until we no longer have a valid reason for keeping it.
    • Until you request us to stop using it.
    • For as long as required by law e.g., we keep invoice information for seven years to fulfil our tax obligations.

    We will also take reasonable steps to destroy your personal information or put it beyond use (e.g., de-identify the personal information so it cannot be used to identify you) once we no longer require it for the purposes for which it was collected or for any secondary purpose permitted under the APPs.

     

    7. Disclosure of personal information

    We may disclose information about you to third parties or entities outside of our business, including where it is reasonably necessary for the purpose of assessing, managing and progressing your matter, claim or enquiry or where we are required to disclose your information by law such as in the instance of an investigation into bankruptcy, counter-terrorism, fraud, taxation or in response to a subpoena.

    We may disclose your information and collect your information from:

    • Our related entities and businesses that we have a relationship with.
    • Anybody who represents you, such as financial advisers, lawyers, guardians, persons holding power of attorney and accountants.
    • Courts, tribunals, ombudsmen and commissions.
    • Government departments, agencies and regulatory bodies, this may include the Australian Taxation Office, Medicare, Centrelink, the National Disability Insurance Agency or a worker’s compensation authority.
    • Third party experts and other persons including doctors, health professionals, accountants, actuaries, third-party law practices and barristers.
    • Claims related providers, such as assessors and investigators who help us with claims.
    • Third-party insurers including private health insurers for the purpose of discussing your claim, obtaining information about services provided to you, and/or negotiating refunds.
    • Third-party medical and health service providers for the purpose of obtaining medical records or information.
    • Employers, former employers and superannuation providers.
    • Third parties when outsourcing services, such as data storage, debt collection, bulk distribution and mailing services, direct marketing, technology support services, business development and obtaining expert help from consultants to improve our services.
    • Identity verification service providers, including document issuers, official record holders, service providers, government or regulatory bodies, credit agencies or other information holders and repositories (including via third party systems).
    • Potential purchasers/organisations involved in the proposed sale of our business (or part of our business) for the purpose of due diligence, corporate re-organisation or transfer of all or part of the assets of our business.
    • Social media sites on which we have a presence, to the extent that you interact with us via a social media site.
    • Anyone who assists us to identify, prevent or investigate suspicious matters, fraud, unlawful activity, misconduct or threats to our systems.
    • Third parties to anonymise and aggregate statistical information.
    • Other third parties from time to time with your implied or express consent or as required or authorised by law.

    If your personal information is made available to the Court, that information will usually be on the public record.

    We may also disclose your personal and health information where it is required by law to do so, or where it is necessary to assess your eligibility to receive compensation or otherwise manage or progress your claim.

    We will not disclose personal information to third parties, other than as set out in this Privacy Policy or without your consent, unless it becomes necessary to lessen or prevent a serious and imminent threat to life, health or safety or unless we are otherwise compelled by law.

    At no time will sell or transfer your personal information to third parties for the purpose of allowing them to send marketing material to you without your consent.

     

    8. Storage and security

    8.1 Storage of personal information

    The personal information we hold about you may be held by us in electronic or paper form.

    Generally, we do not store our data outside of Australia. However, there may be times when we store personal information with vendors who have been contracted to provide customer relationship systems and technological solutions. For example, we may utilise international cloud computing services for document sharing, e-mail storage and to store personal information that we collect. Countries in which such data may be stored may include (but are not limited to) the United Kingdom, Japan, Netherlands and the United States. Because the security of personal information about our clients and prospective-clients (i.e. individuals who have made an enquiry but did not instruct us to act on their behalf) is of a paramount concern to us, we seek confirmation that such service providers comply with the APPs or are subject to a binding law or scheme that offers substantially similar protection. Although information is encrypted where possible and efforts are made to protect your personal information, when you agree to this Privacy Policy you acknowledge that we will not be responsible for the overseas third party.

    Generally, we do not disclose personal information to overseas parties unless required by law or enforcement activity or unless we are seeking information to further a claim, e.g., if we are working with international service providers. Any such disclosure or transfer of information does not change any of our commitments to safeguard your privacy and the information remains subject to existing confidentiality obligations.

    8.2 Destruction of personal information

    When all our legal obligations to retain your personal information have expired, or we no longer need your information for a purpose permitted under law, we may take such steps as are reasonable to destroy or de-identify the information.

    8.3 How we keep your information safe

    We take reasonable steps to protect your information from misuse, interference and loss, as well as unauthorised access, modification or disclosure and we use a number of physical, administrative, personnel and technical measures to protect your personal information, e.g., passwords, firewalls, intrusion detection and virus scanning tools; and building security measures.

    Despite this, we cannot provide any assurance or guarantee regarding the security of your personal information or the transmission of information you communicate to us online (including by email). We also cannot guarantee that the information you supply will not be intercepted while being transmitted over the internet (including by email). Accordingly, any personal information or other information which you transmit to us online or by email is transmitted at your own risk.

     

    9. Privacy on our website

    9.1 Using our website and cookies

    We may collect personal information about you when you use and access our website and through emails, e.g., through the use of ‘cookies’ which is a small text file that is placed on your computer or internet-enabled device whenever you visit our website.

    While we do not use browsing information to identify you personally, we may record certain information about your use of our website, such as which pages you visit, duration on each page, the time and date of your visit and the internet protocol address assigned to your computer.

    9.2 Automatic collection of personal information

    Cookies and other technologies may be used by us on our website and through email to automatically collect certain types of information. The collection of this information allows us to customise your online experience, market products and services to you, improve the performance, usability and effectiveness of our online presence and to measure the effectiveness of our marketing activities.

    If you use our website and provide information about your preferences, then we may use your information to personalise your user experience. If you use our website using a third-party account, we may collect any information you have permitted the third-party service to share, such as your name and email address, which will be dependent on the privacy settings that have been set with the third-party service provider and their privacy policy.

    9.3 IP addresses

    An IP address is a number assigned to your computer whenever you access the internet. It is not linked to personally identifiable information. We may use IP addresses to analyse trends, administer the website, track user’s movement, and gather broad demographic information.

    9.4 Cookies

    A ‘cookie’ is a small text file that is placed on your computer or internet-enabled device by our web server whenever you visit our website. This allows our website to remember your computer or device and serves a number of other purposes.

    The use of cookies is an industry standard, and many major browsers are initially set up to accept them. You can reset your browser settings to either refuse to accept all cookies or to notify you when you have received a cookie. You may also delete cookies from your device at any time. However, if you refuse to accept cookies, you may not be able to access or use all of the features available on our website.

    Cookies by themselves do not tell us your email address or otherwise identify you personally. In our analytical reports, we may obtain other identifiers including IP addresses, but this is for the purpose of identifying the number of unique visitors to our website and geographic origin of visitor trends, and not to identify individual visitors.

    9.5 Web analytics

    We may use web analytic tools to collect information about use of our website and our services, with the goal of improving our service offerings. These web analytic tools collect information such as how often users visit our website and use our services, what pages they visit when they do so, and what other sites they used prior to coming to the site. 

    9.6 Location-based tools

    We may collect and use the geographical location of your computer or mobile device. This location data is collected for the purpose of providing you with information regarding services which we believe may be of interest to you based on your geographic location, and to improve our location-based products and services (if applicable).

    9.7 Social media features

    Our website may host blogs, forums and other applications or we may operate social media accounts (such as Facebook or Instagram) (collectively “social media features”). The purpose of social media features is to facilitate the sharing of knowledge and content. Any personal information that you provide on any Elliott May social media feature may be shared with other users of that social media feature (unless otherwise stated at the point of collection), over whom we may have limited or no control.

    9.8 Links

    Our website may contain links to websites operated by third parties. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage you to read them before using those websites before you provide access to your personal information. Unless expressly stated otherwise, we do not endorse, approve or recommend the company, product or service provided on or associated with any external link.

    The supply of personal information over the internet (including via websites operated by third parties) is at your own risk.

     

    10. Children

    We understand the importance of protecting children’s privacy, especially in an online environment. Our website is not intentionally designed for or directed at children under the age of 18.  It is our policy to never knowingly collect or maintain information about anyone under the age of 18, except as part of a specific engagement to provide services or products that necessitates such personal information being collected, e.g., to comply with our legal obligations.

     

    11. Accessing and correcting your personal information

    Personal information may be accessed by personnel within Elliott May. All personnel within Elliott May are bound by confidentiality laws and standards that govern the legal profession within Australia and to comply with the APPs.

    You can request access to the personal information we hold about you by contacting us using the information below, subject to some limited exceptions permitted or required by law. Sometimes, we may not be able to provide you with access to all your information and, where this is the case, we will endeavour to explain why. We may also need to verify your identity when you request access to your information.

    We will not provide you with access to information which would reveal any confidential formulae or the detail of any in-house evaluative decision-making process but may instead provide you with the result of the formulae or process or an explanation of that result (if applicable).

    If you believe that information we hold about you is incorrect or out of date, or if you have concerns about how we are handling your personal information, please contact us and we will try to resolve those concerns, including taking reasonable steps to ensure that our records are corrected in accordance with the requirements of the Privacy Act.

    If you wish to have your personal information deleted, then please let us know and we will take reasonable steps to delete it (unless we need to keep it for legal or internal risk management reasons, or compliance with our professional obligations).

     

    12. Making a complaint

    If you wish to make a complaint about the way we collect, use, hold or disclose your personal information, then you can contact us using the details set out below. Please include your name, email address and/or telephone number and clearly describe your complaint. We will acknowledge your complaint and respond to you regarding your complaint within a reasonable period.

    If you are not satisfied with how we have dealt with your complaint you can contact the Office of the Australian Information Commissioner using any of the following details:

    Post:
    Office of the Australian Information Commissioner
    GPO Box 5288
    Sydney NSW 2001

    E:
    T: 1300 363 992
    www.oaic.gov.au

     

    13. Changes to this Privacy Policy

    We may modify or amend this Privacy Policy from time to time. Before providing us with personal information, please review our current Privacy Policy.

    To let you know when we make changes to this Privacy Policy, we will amend the revision date. The new modified or amended Privacy Policy will apply from that revision date. Therefore, we encourage you to periodically review this Privacy Policy to be informed about how we are protecting your information.

    This Privacy Policy supersedes and replaces all previous privacy policies issued by us that you may have received or accessed, including those contained in or referred to in any correspondence, telephone call or document.

     

    14. Our contact details

    For further information about our Privacy Policy or practices, or to access or correct your information, or make a complaint, please contact us using the details set out below:

    Elliott May Lawyers Pty Ltd
    Attention: Privacy Officer

    Post:      
    PO Box 1224
    Milton, Queensland 4064
    Australia

    E:
    T: 1300 112 484
    www.elliottmay.com.au

     

    Solutions. Not just advice

    Talk With Us